0

When I run auditctl -l I got:

# auditctl -l
No rules
File system watches not supported

And I've already have AUDITSYSCALL enable in kernel,

# zgrep AUDIT /proc/config.gz
CONFIG_AUDIT_ARCH=y
CONFIG_AUDIT=y
CONFIG_AUDITSYSCALL=y
CONFIG_AUDIT_TREE=y

So what could be wrong here? I'm using auditctl version 1.0.12 with kernel 2.6.32

1 Answer 1

0

First understand how the audit system works and how to add syscall rules using auditctl.

This opensuse doc page might be helpful.

1
  • It would not be the first time that SuSE documentation was no longer accessible, your link would be invalidated and your answer unhelpful. You should copy the relevant material here, and use the link as a pointer to more detailed (but inessential) information as well as for giving credit.
    – Anthon
    Sep 16, 2014 at 5:43

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .