On Mon, 2005-08-01 at 20:26 +0200, Vassilios Kotoulas wrote:
hi,
when auditd starts on boot I get an error message about a syntax error
in /etc/audit.rules in line 5
this is the file:
# This file contains the auditctl rules that are loaded
# whenever the audit daemon is started via the initscripts.
#
# First rule - delete all
-D
#
# Feel free to add below this line. See auditctl man page
#
# Increase the buffers to survive stress events
-b 256
I can't find -D in the auditctl(8). Is it a remain from fc3? I did an
update fc3 -> fc4 some days ago. How must the first rule look now?
It's fine.
Have you applied all updates?
Are you not running SELinux in enforcing mode?
See:
https://bugzilla.redhat.com/bugzilla/show_bug.cgi?id=163223
Paul.
--
Paul Howarth <paul(a)city-fan.org>