auditing support for FC2 w/ kernel 2.6.10-1.771_FC2

[Verbeeck Derek]

Greetings,
	I'm trying to get audit support working w/ FC2 and kernel 2.6.10
(provided from a yum repository and recompiled from that source). The
issue is that even when both audit support and syscall auditing are
flagged on in .config, when the system is booting with a rebuilt kernel,
I am not seeing a /dev/audit device file, so the audit software I'm
trying to use fails. I'm trying to use laus, a third party application
written by Novell, which builds fine from source, but fails due to lack
of /dev/audit. I have tried to mknod the device file myself with no
success, it still complains about not having the audit device.
	Does anyone have experience with a similar scenario? Am I going
about this the wrong way?

Thanks for your time!

Derek Verbeeck
System Administrator
Advanced Acoustic Concepts
631-273-5700 ext 2305

[Steve G]

> Does anyone have experience with a similar scenario? Am I going about
> this the
> wrong way? 
Yep. What you are talking about is laus - which is a Suse audit system. The 2.6
kernel has a native audit system that works completely different from Laus. The
user space package can be found at http://people.redhat.com/sgrubb/audit. The
latest stable version is 1.0.14.

I want to think that you need 2.6.14 kernel to have most problems solved. You can
try the older kernel and if you run into problems you should look for something
newer.

-Steve

__________________________________________________
Do You Yahoo!?
Tired of spam?  Yahoo! Mail has the best spam protection around 
http://mail.yahoo.com