I am running a RHEL ES 5.4 system (64bit), fully patched. I am trying to configure auditing, and I am using a rule such as this:
-a exit,always -S chmod -S lchown -S chown -F success=0 -F exit!=-11 And I am getting the follow warning when restart auditd: WARNING = 32/64 bit syscall mismatch in line 36, you should specify an arch I googled, and came up with something from the RH archives http://www.mail-archive.com/[email protected]/msg03169/AUDIT.RULES indicating that I should add an "arch=b64" to the line, but this yields an error: "parameter passed without an option given". I'm trying to use my 32bit audit.rules on a 64 bit machine, and am having trouble getting rid off all the warnings. Can anyone help? Thanks. ----- Bill Tangren IAM U.S. Naval Observatory, Washington
smime.p7s
Description: S/MIME cryptographic signature
_______________________________________________ rhelv5-list mailing list [email protected] https://www.redhat.com/mailman/listinfo/rhelv5-list
