I have recently made changes to my audit.rules file on a 32bit RHEL 6.9 machine and I know that since the end of the file has -e 2 to make the file immutable a reboot is required for the new rules to take effect.

Thus, the machine was rebooted and the auditd service started correctly and running the command auditctl -l verifies that the expected rules are loaded.

However, after the reboot and confirmation of the correct loading of the audit rules whenever I run the command:

service auditd restart

The following is output:

Stopping auditd:                                           [  OK  ]
Error deleting rule (Operation not permitted)
Error sending enable request (Operation not permitted)
Starting auditd:                                           [  OK  ]

My issue I am wondering about is why if no new rules have since been added to the audit.rules file since the reboot why are those errors popping up?

From my understanding, they should only pop up if the file is set to immutable and you try to load new rules during runtime.


By setting "-e 2" you are enabling AND LOCKING auditd's configuration so it CANNOT BE CHANGED. Therefore, it will not allow you to stop it, as would happen for a restart. Stopping auditing would be a change - something you have instructed it to not allow to happen. That is why you get that error when attempting to restart it. Either set "-e 1" and reboot to enable auditd and NOT have it immutable, or reboot for any changes you make with "-e 2" still set.


You can add audit rules using "auditctl -a" that will come with immediate effect but will not survive reboot. To make it persistant write it to the audit.rules file so that both runtime and persistancy become sync. Thumb rule for auditd service, you can not start auditd using service auditd start/restart . A reboot is must to start/restart auditd.

  • This does not answer my question, I am not even using systemctl as RHEL 6 still uses services for auditd and as have said already edited the audit.rules file. – jgr208 Nov 8 '18 at 14:39
  • I missed the version information on your question. Either way you have to restart auditd service by rebooting the system. – al mamun Nov 8 '18 at 14:45
  • which as stated in my question i already have – jgr208 Nov 8 '18 at 14:46
  • so, what is your question!! despite of changing anything or not system MUST be rebooted to restart auditd service. – al mamun Nov 8 '18 at 14:49
  • 2
    the question is stated in my question please reread – jgr208 Nov 8 '18 at 14:50

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.