On Wednesday, April 12, 2017 10:18:55 AM EDT warron.french wrote:
> It appears that this directory is not used at all on RHEL6.
>
> I know I have mentioned this before; but it's true. If I *move* my copy of
> audit.rules from /etc/audit into the subdirectory rules.d and restart
> audit; the audit
There is a different default setting between rhel6 and 7. See
/etc/default/auditd I think has a parameter that controls the use of
/etc/audit/rules.d.
Sent from my mobile phone, please excuse the brevity.
On Apr 12, 2017, 7:19 AM, at 7:19 AM, "warron.french"
wrote:
>It appears that this dir
- Original Message -
> From: "warron.french"
> To: linux-audit@redhat.com
> Sent: Wednesday, April 12, 2017 10:18:55 AM
> Subject: rules.d on RHEL6
>
> It appears that this directory is not used at all on RHEL6.
>
> I know I have mentioned this before
It appears that this directory is not used at all on RHEL6.
I know I have mentioned this before; but it's true. If I *move* my copy of
audit.rules from /etc/audit into the subdirectory rules.d and restart
audit; the audit.rules file is not recopied/regenerated or whatever by the
auditd.
This beh
