On Wednesday 11 October 2006 07:49, Boyce, Kevin P. (Melbourne, FL) wrote: > I can install the deb files and the audit daemon runs, but it has trouble > parsing the audit.rules file. The error I am getting is "Error sending > insert watch request (Invalid Argument)."
This is not a parsing error...its worse. The audit 1.0.x series was developed to compliment the RHEL4 kernel. At the time, it was envisioned that the technique used for watches would be accepted upstream. It was rejected due to some overlap with inotify, so the watch system was re-written. The audit 1.2.x series has the code for the new system. Watches were not accepted upstream until the 2.6.18 kernel. > I have a requirement to use these two kernel versions, and unfortunately > can't use redhat, fedora, or their kernel binaries. They you are limited to inode based auditing. Or maybe if you put the things you have to watch onto one partition, you can use devmajor and minor. I'd try to move to a 2.6.18 kernel with the latest audit package. -Steve -- Linux-audit mailing list [email protected] https://www.redhat.com/mailman/listinfo/linux-audit
