On Thursday, July 8, 2021 10:26:57 AM EDT warron.french wrote: > I am required to place the following rule into my audit configurations, but > when I do auditd will stop loading rules from this particular rule forward > to the end. > > -a always,exit -F path= /etc/NetworkManager/ -F perm=wa -F > key=system-locale
There is a space between path= and /etc. Usually systemd puts auditctl messages in syslog/journal. -Steve -- Linux-audit mailing list [email protected] https://listman.redhat.com/mailman/listinfo/linux-audit
