Hello,
Thanks for your reply.
Auditd is giving me a weird error that google has shown is more common
than it should be. If the answer to this next question is what I'm
thinking it is, that very likely means a kernel issue.
The question is this, what kernel version (I believe it is 6.x?) comes
with Debian 12? The reason I ask is because of this:
#uname -a
Linux hostname.example.com 4.19.0 #1 SMP Thu Dec 15 20:31:06 MSK 2022
x86_64 GNU/Linux
#uname -r
4.19.0
#hostnamectl
Static hostname: hostname.example.com
Icon name: computer-container
Chassis: container ?
Machine ID: xxx
Boot ID: xxx
Virtualization: openvz
Operating System: Debian GNU/Linux 12 (bookworm)
Kernel: Linux 4.19.0
Architecture: x86-64
I don't think that is correct.
Thanks.
Dave.
On 6/27/23, Reco <recovery...@enotuniq.net> wrote:
> Hi.
>
> On Tue, Jun 27, 2023 at 10:54:32AM -0400, David Mehler wrote:
>> used because the interface(s) are all getting there IP addresses
>> statically assigned.
>
> New plan then.
>
> apt install auditd
> echo '-a always,exit -F arch=b64 -S sethostname' \
> > /etc/audit/rules.d/hostname.rules
> echo '-a always,exit -F path=/proc/sys/kernel/hostname -F perm=wa' \
> >> /etc/audit/rules.d/hostname.rules
> service auditd restart
> reboot
>
> Whatever's trying to change the hostname should leave a trace in
> /var/log/audit/audit.log.
>
>
> PS Here it's customary to reply at the bottom of e-mail, not at the top.
> There's no need to quote the mail you're replying to in full.
>
> Reco
>
>
