Hello, Thanks for your reply.
Auditd is giving me a weird error that google has shown is more common than it should be. If the answer to this next question is what I'm thinking it is, that very likely means a kernel issue. The question is this, what kernel version (I believe it is 6.x?) comes with Debian 12? The reason I ask is because of this: #uname -a Linux hostname.example.com 4.19.0 #1 SMP Thu Dec 15 20:31:06 MSK 2022 x86_64 GNU/Linux #uname -r 4.19.0 #hostnamectl Static hostname: hostname.example.com Icon name: computer-container Chassis: container ? Machine ID: xxx Boot ID: xxx Virtualization: openvz Operating System: Debian GNU/Linux 12 (bookworm) Kernel: Linux 4.19.0 Architecture: x86-64 I don't think that is correct. Thanks. Dave. On 6/27/23, Reco <recovery...@enotuniq.net> wrote: > Hi. > > On Tue, Jun 27, 2023 at 10:54:32AM -0400, David Mehler wrote: >> used because the interface(s) are all getting there IP addresses >> statically assigned. > > New plan then. > > apt install auditd > echo '-a always,exit -F arch=b64 -S sethostname' \ > > /etc/audit/rules.d/hostname.rules > echo '-a always,exit -F path=/proc/sys/kernel/hostname -F perm=wa' \ > >> /etc/audit/rules.d/hostname.rules > service auditd restart > reboot > > Whatever's trying to change the hostname should leave a trace in > /var/log/audit/audit.log. > > > PS Here it's customary to reply at the bottom of e-mail, not at the top. > There's no need to quote the mail you're replying to in full. > > Reco > >