On Wednesday 09 January 2008 14:01:39 Brennan, William C wrote: > I'm attempting to use the auditd package (1.5.4) as supplied downstream > in the Ubuntu distribution. I'm encountering a problem (as a few others > are as well, Ubuntu bug #140784) in that we can't get auditctl to > successfully handle any new rules. For me, this version of auditd has > not worked at all.
I'd start with asking if the kernel supports auditing. Auditctl has no dependencies on anything in userspace aside from a normal glibc. -Steve -- Linux-audit mailing list [email protected] https://www.redhat.com/mailman/listinfo/linux-audit
