0

I have some rules in the audit.conf file. When do auditctl -l, they don't show up. If I restart the auditd service and do auditctl -l again, then the rules show up. Any idea why this? Where can I check if there are errors during boot?

Improve this question

1 Answer 1

Reset to default
1

This is normal behavior. You must restart the audit daemon to make use of changes so that it re-reads the /etc/audit/ files. IF you add the rule using auditctl, it will work immediately, but will be non-persistent.

Improve this answer

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .