FC4 Problems with auditd

[Vassilios Kotoulas]

hi,

when auditd starts on boot I get an error message about a syntax error
in /etc/audit.rules in line 5

this is the file:

# This file contains the auditctl rules that are loaded
# whenever the audit daemon is started via the initscripts.
#
# First rule - delete all
-D
#
# Feel free to add below this line. See auditctl man page
#
# Increase the buffers to survive stress events
-b 256

I can't find -D in the auditctl(8). Is it a remain from fc3? I did an
update fc3 -> fc4 some days ago. How must the first rule look now?

regards
vassilios

[Paul Howarth]

On Mon, 2005-08-01 at 20:26 +0200, Vassilios Kotoulas wrote:
> hi,
>
> when auditd starts on boot I get an error message about a syntax error
> in /etc/audit.rules in line 5
>
> this is the file:
>
> # This file contains the auditctl rules that are loaded
> # whenever the audit daemon is started via the initscripts.
> #
> # First rule - delete all
> -D
> #
> # Feel free to add below this line. See auditctl man page
> #
> # Increase the buffers to survive stress events
> -b 256
>
> I can't find -D in the auditctl(8). Is it a remain from fc3? I did an
> update fc3 -> fc4 some days ago. How must the first rule look now?

It's fine.

Have you applied all updates?
Are you not running SELinux in enforcing mode?

See:
https://bugzilla.redhat.com/bugzilla/show_bug.cgi?id=163223

Paul.