auditctl complains with "There was an error in line 2 of /etc/audit/audit.rules" and no rule gets loaded
Issue
-
When starting the auditd service, the following
auditctlmessage is seen in the journal and no rule gets loaded[...] auditctl[XXX]: There was an error in line 2 of /etc/audit/audit.rules -
Content of
/etc/audit/audit.rulesfile looks correct, e.g.## This file is automatically generated from /etc/audit/rules.d -D [...]or when the rule file is something customized (content may vary)
# Do not edit any of these rules directly. The contents of this file are # controlled by an automation tool
Environment
- Red Hat Enterprise Linux 7 and later
- auditd
Subscriber exclusive content
A Red Hat subscription provides unlimited access to our knowledgebase, tools, and much more.