Henning, Arthur C. (CSL) wrote: > Using system-config-audit getting key (-k) configuration errors when > saving changes. > > [EMAIL PROTECTED] ~]# Stopping auditd: [ OK ] > Starting auditd: [ OK ] > key option needs a watch or syscall given prior to it
This is telling you that the -k flag needs to be after a -S flag. I don't know why the order matters but apparently it does. > There was an error in line 9 of /etc/audit/audit.rules > cat /etc/audit/audit.rules > -e 1 > -f 2 > -b 8192 > -r 0 > > -D > -a entry,always -S adjtimex -S settimeofday > -a entry,always -S clock_settime > -a entry,always -k kill -S kill try: -a entry, always -S kill -k kill And for the rest, make the -k stuff to the end. > -a exit,always -k system-locale -S sethostname > -a exit,always -F exit=-13 -k creation -S creat -S mkdir -S mknod -S > link -S symlink > -a exit,always -F exit=-13 -k creation -S mkdirat -S mknodat -S linkat > -S symlinkat > > If I remove the key from line 9 and save, get error reported line 10, > etc. > > Started with NISPOM.rules contrib file. Are the options in the wrong order in the contrib file too? The draft I saw posted for comments was in the correct order but I haven't looked at what's currently shipped. -- ljk > > Art Henning (CSL) > Enterprise IT Solutions > Northrop Grumman Corp > [EMAIL PROTECTED] > > > -- > Linux-audit mailing list > [email protected] > https://www.redhat.com/mailman/listinfo/linux-audit -- Linux-audit mailing list [email protected] https://www.redhat.com/mailman/listinfo/linux-audit
