<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 3.2//EN"> <HTML> <HEAD> <META HTTP-EQUIV="Content-Type" CONTENT="text/html; charset=iso-8859-1"> <META NAME="Generator" CONTENT="MS Exchange Server version 6.5.7650.3"> <TITLE>RE: auditctl question</TITLE> </HEAD> <BODY>  I built the kernel from the Linux Kernel Archives, not SuSE. I got the latest audit source from the audit-1.2.x site. The audit software seems to compile fine upto audit-1.2.3, but it fails with the compile errors as described earlier, with versions audit-1.2.4 upwards. Is audit being developed strictly under the Red Hat build? Do I need some package that I am missing? Thanks, Lane -----Original Message----- From: Steve Grubb [<A HREF="mailto:sgrubb@redhat.com">mailto:sgrubb@redhat.com</A>] Sent: Thu 8/3/2006 5:06 PM To: linux-audit@redhat.com Cc: Williams, P. Lane; Klaus Weidner Subject: Re: auditctl question On Thursday 03 August 2006 16:02, Williams, P. Lane wrote: > I also received the same error with the other kernel. I did not build the > SE-Linux stuff into the kernel, should I have? I think the kernel headers are your problem. I don't think I'd replace that. And you do not have to have SE Linux enabled since this is a define from the audit kernel headers. That said, I don't think you need to rebuild the user space package. The problem you are seeing would be a kernel bug most likely. It is what evaluates the rules and decides if it needs to output an event. So, with the new kernel and auditctl from Suse, do you see the problem? Thanks, -Steve </BODY> </HTML>