Hello, On Monday, January 30, 2023 12:21:53 AM EST Anurag Aggarwal wrote: > As per my understanding, currently auditd picks up rule files as per > alphabetical order.
Auditd picks up the rules in /etc/audit/audit.rules That in turn is compiled by augenrules which uses the order as given from "ls -v". > Is there a way to force auditd to prioritize which rule file should be > first read and applied, other than renaming it as 000-<app>.rules and > hoping that customers don't have anything lexicographically smaller than > this? You can use "ls -v" to figure out how to make a rule that is ahead of 10-base- config.rules. even 10-a.rule should go first. Or you can rename 10-base- config.rules to be a higher number. -Steve -- Linux-audit mailing list Linux-audit@redhat.com https://listman.redhat.com/mailman/listinfo/linux-audit
