Yes! -------------------------- Warron French
On Thu, Jul 8, 2021 at 2:47 PM Richard Guy Briggs <[email protected]> wrote: > On 2021-07-08 13:33, warron.french wrote: > > Ah! that was a typo in my email typing, since I could not copy paste from > > where the syntax was to my email I was typing. > > Could it be you are trying to add a directory with a path field? > > > Thanks Steve. > > -------------------------- > > Warron French > > > > On Thu, Jul 8, 2021 at 11:11 AM Steve Grubb <[email protected]> wrote: > > > On Thursday, July 8, 2021 10:26:57 AM EDT warron.french wrote: > > > > I am required to place the following rule into my audit > configurations, > > > but > > > > when I do auditd will stop loading rules from this particular rule > > > forward > > > > to the end. > > > > > > > > -a always,exit -F path= /etc/NetworkManager/ -F perm=wa -F > > > > key=system-locale > > -a always,exit -F dir=/etc/NetworkManager/ -F perm=wa -F key=system-locale > > > > There is a space between path= and /etc. Usually systemd puts auditctl > > > messages in syslog/journal. > > > > > > -Steve > > - RGB > > -- > Richard Guy Briggs <[email protected]> > Sr. S/W Engineer, Kernel Security, Base Operating Systems > Remote, Ottawa, Red Hat Canada > IRC: rgb, SunRaycer > Voice: +1.647.777.2635, Internal: (81) 32635 > >
-- Linux-audit mailing list [email protected] https://listman.redhat.com/mailman/listinfo/linux-audit
