I have recently made changes to my
audit.rules file on a 32bit RHEL 6.9 machine and I know that since the end of the file has
-e 2 to make the file immutable a reboot is required for the new rules to take effect.
Thus, the machine was rebooted and the
auditd service started correctly and running the command
auditctl -l verifies that the expected rules are loaded.
However, after the reboot and confirmation of the correct loading of the audit rules whenever I run the command:
service auditd restart
The following is output:
Stopping auditd: [ OK ] Error deleting rule (Operation not permitted) Error sending enable request (Operation not permitted) Starting auditd: [ OK ]
My issue I am wondering about is why if no new rules have since been added to the
audit.rules file since the reboot why are those errors popping up?
From my understanding, they should only pop up if the file is set to immutable and you try to load new rules during runtime.