0

i am using

/etc/audit/rules.d/*.rules

files to generate the

/etc/audit/audit.rules

which has 120 lines.

But if i run

auditctl -l

i get only 14 lines as a result though.

Why is this happening ?

  • Please provide more detailed information, ex: input and output files – mrc02_kr Sep 20 '17 at 9:33
0

You need to execute augenrules.

This is an executable script that goes over the rules you have in rules.d and compiles them into a single valid file.

For that reason, you should also make sure that all the files in rules.d end with a new line. Otherwise, the resulting file will have a invalid rules.

You may not have that script if you are using an older version of auditd. But in fact, it is just a script, and you can take it from a newer version of auditd and place it somewhere in the path. Although, I would not recommend it, instead, if that is the case, you should upgrade auditd to a newer version.

|improve this answer|||||

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.