The audit rule is invalid when the folder in the rule is missing.
Issue
-
The audit rule is invalid when the folder in the rule is missing.
For example:# ll /root/test/test1 ls: cannot access '/root/test/test1': No such file or directory # ll /root/test/ ls: cannot access '/root/test/': No such file or directory # grep test /etc/audit/rules.d/audit.rules -w /root/test/test1/ -p warx -k test # service auditd restart Stopping logging: Redirecting start to /bin/systemctl start auditd.service # auditctl -l No rules
Environment
- Red Hat Enterprise Linux 6
- Red Hat Enterprise Linux 7
- Red Hat Enterprise Linux 8
- Red Hat Enterprise Linux 9
- auditd
Subscriber exclusive content
A Red Hat subscription provides unlimited access to our knowledgebase, tools, and much more.