<html><body> My audit install script installs your rules file with the -e 2 uncommented so I will have to adjust the script to account for this. Thanks Steve David Flatley CISSP <img width="16" height="16" src="cid:1__=0ABBFC20DFD827258f9e8a93df938@us.ibm.com" border="0" alt="Inactive hide details for Steve Grubb ---01/21/2010 04:50:38 PM---On Thursday 21 January 2010 04:29:04 pm David Flatley wrote: ">Steve Grubb ---01/21/2010 04:50:38 PM---On Thursday 21 January 2010 04:29:04 pm David Flatley wrote: > Auditd fails to start due to -D in th <table width="100%" border="0" cellspacing="0" cellpadding="0"> <tr valign="top"><td width="1%"><img width="96" height="1" src="cid:2__=0ABBFC20DFD827258f9e8a93df938@us.ibm.com" border="0" alt=""> From:</td><td width="100%"><img width="1" height="1" src="cid:2__=0ABBFC20DFD827258f9e8a93df938@us.ibm.com" border="0" alt=""> Steve Grubb <sgrubb@redhat.com></td></tr> <tr valign="top"><td width="1%"><img width="96" height="1" src="cid:2__=0ABBFC20DFD827258f9e8a93df938@us.ibm.com" border="0" alt=""> To:</td><td width="100%"><img width="1" height="1" src="cid:2__=0ABBFC20DFD827258f9e8a93df938@us.ibm.com" border="0" alt=""> linux-audit@redhat.com</td></tr> <tr valign="top"><td width="1%"><img width="96" height="1" src="cid:2__=0ABBFC20DFD827258f9e8a93df938@us.ibm.com" border="0" alt=""> Cc:</td><td width="100%" valign="middle"><img width="1" height="1" src="cid:2__=0ABBFC20DFD827258f9e8a93df938@us.ibm.com" border="0" alt=""> David Flatley/Burlington/IBM@IBMUS</td></tr> <tr valign="top"><td width="1%"><img width="96" height="1" src="cid:2__=0ABBFC20DFD827258f9e8a93df938@us.ibm.com" border="0" alt=""> Date:</td><td width="100%"><img width="1" height="1" src="cid:2__=0ABBFC20DFD827258f9e8a93df938@us.ibm.com" border="0" alt=""> 01/21/2010 04:50 PM</td></tr> <tr valign="top"><td width="1%"><img width="96" height="1" src="cid:2__=0ABBFC20DFD827258f9e8a93df938@us.ibm.com" border="0" alt=""> Subject:</td><td width="100%"><img width="1" height="1" src="cid:2__=0ABBFC20DFD827258f9e8a93df938@us.ibm.com" border="0" alt=""> Re: How to learn the Message type?</td></tr> </table> <hr width="100%" size="2" align="left" noshade style="color:#8091A5; "> <tt>On Thursday 21 January 2010 04:29:04 pm David Flatley wrote: > Auditd fails to start due to -D in the /etc/audit/audit.rules file on > two of my RHEL 5.3 systems. > I am using Steve Grubb's STIG audit.rules file. Did I miss something with > 5.3?? The very last command in that file puts the audit system in immutable mode - meaning you cannot change the rules without rebooting. Comment out that line if you want to let any changes into the audit system at any time. -Steve </tt> </body></html>