There is a different default setting between rhel6 and 7. See /etc/default/auditd I think has a parameter that controls the use of /etc/audit/rules.d.
Sent from my mobile phone, please excuse the brevity. On Apr 12, 2017, 7:19 AM, at 7:19 AM, "warron.french" <warron.fre...@gmail.com> wrote: >It appears that this directory is not used at all on RHEL6. > >I know I have mentioned this before; but it's true. If I *move* my >copy of >audit.rules from /etc/audit into the subdirectory rules.d and restart >audit; the audit.rules file is not recopied/regenerated or whatever by >the >auditd. > >This behavior is different from RHEL7; where if you delete the >/etc/audit/audit.rules file or move it to >/etc/audit/rules.d/audit.rules; >the auditd functions as I expect. > > >Can someone please correct my understanding? Is the /etc/audit/rules.d >directory not supposed to be usable in RHEL6; but is in RHEL7? >-------------------------- >Warron French > > >------------------------------------------------------------------------ > >-- >Linux-audit mailing list >Linux-audit@redhat.com >https://www.redhat.com/mailman/listinfo/linux-audit
-- Linux-audit mailing list Linux-audit@redhat.com https://www.redhat.com/mailman/listinfo/linux-audit
