I've a confusion over RedHat entriprise linux audit rules. The audit.rules contains the following

# This file contains the auditctl rules that are loaded
# whenever the audit daemon is started via the initscripts.
# The rules are simply the parameters that would be passed
# to auditctl.

# First rule - delete all

# Increase the buffers to survive stress events.
# Make this bigger for busy systems
-b 320

# Feel free to add below this line. See auditctl man page

From the documentation -D means:

deletes all currently loaded Audit rules, for example:

so what would the above audit.rules generate? audit.log what kind of info would it be there? how can i know what's being monitored? My initial understanding of this rule is that it would delete all the previous audited actions once a reboot is done, but after that what's actually being audited?

your clarification is really appreciated

1 Answer 1


By default, there are no audit rules. This file exists as a basis to write your own rules. There isn't any rule that's useful on all system, so the distribution doesn't come with rules. What you need to log depends on what you use your system for and what you want to know about it.

The file starts by wiping existing rules so that you can restart the audit service on a running system, and you'll get to a known state, independent of what rules were present before.

Note that usually, rules are written in files in /etc/audit/rules.d. This makes it easier to manipulate independent sets of rules, especially if some files come from packages or from configuration management software such as Puppet or Ansible. The file /etc/audit/audit.rules is regenerated just before (re)starting the audit service.

  • so the -D is by default meaning it's doing nothing? # First rule - delete all -D May 22, 2017 at 11:36
  • @Mr.Curious -D does nothing at boot time. It's useful if you reload the rules: it deletes any rules that were previously set, before adding the new rules. May 22, 2017 at 22:51

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .