I've a confusion over RedHat entriprise linux audit rules. The audit.rules contains the following
# This file contains the auditctl rules that are loaded # whenever the audit daemon is started via the initscripts. # The rules are simply the parameters that would be passed # to auditctl. # First rule - delete all -D # Increase the buffers to survive stress events. # Make this bigger for busy systems -b 320 # Feel free to add below this line. See auditctl man page
From the documentation -D means:
deletes all currently loaded Audit rules, for example:
so what would the above audit.rules generate? audit.log what kind of info would it be there? how can i know what's being monitored? My initial understanding of this rule is that it would delete all the previous audited actions once a reboot is done, but after that what's actually being audited?
your clarification is really appreciated