How can I enable audit on access to specific files in Suse Linux Enterprise 9?


Maybe you should take a look at SUSE's official doc

Another useful source of info is auditd's man page which says that all the specific file configurations are in /etc/audit/audit.rules

  • Thanks, but sles 9 has not /etc/audit/audit.conf. I use this in sles 11 – pasgabriele Aug 31 '17 at 7:46
  • If you have rpm try rpm -ql <audit's package name> that will show you the list of files installed by rpm and there should be something related with the rules, I don't think that a very complex software as audit won't have any kind of configuration file or the rules, hope it helps – Christopher Díaz Riveros Aug 31 '17 at 12:42

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.