<div dir="ltr"><div>Steve, can you help me with this please?<br></div>Somehow this slipped past our QA process, but I have an error popping up in <b>/var/log/boot.log</b> indicating:<br><br> <span style="color:rgb(0,0,255)"><b>28</b></span> Starting auditd: ^[[60G[^[[0;32m OK ^[[0;39m]^M<br><b> <span style="color:rgb(0,0,255)">29</span></b> Error sending add rule data request (Rule exists)<br> <b><span style="color:rgb(0,0,255)">30</span> </b>There was an error in line 65 of /etc/audit/audit.rules<br> <br><div><div>Lines 28-30 are the only range of line numbers indicating a problem in the boot.log.<br><br></div><div>I will post a copy of the /etc/audit/audit.rules (for my RHEL6 system) below (with line numbers included for navigation):<br> 1 # This file managed by puppet module: osconfig_eita_mgmt<br> 2 # DO NOT ALTER outside of the Puppet Framework.<br> 3 #<br> 4 #<br> 5 # First rule - delete all<br> 6 -D<br> 7 # Increase the buffers to survive stress events.<br> 8 # Make this bigger for busy systems<br> 9 -b 8192<br> 10 # PANIC on audit failure<br> 11 -f 2<br> 12 #<br> 13 # ACTION (-a) Rules<br> 14 # Filters out noisy cron related messages<br> 15 -a never,user -F subj_type=crond_t<br> 16 #<br> 17 -a always,exit -F arch=b32 -S adjtimex -S settimeofday -S stime -k time-change<br> 18 -a always,exit -F arch=b32 -S adjtimex -S stime -S settimeofday -S clock_settime -k audit_time_rules<br> 19 -a always,exit -F arch=b32 -S chmod -F auid=0 -k perm_mod<br> 20 -a always,exit -F arch=b32 -S chmod -F auid>=500 -F auid!=4294967295 -k perm_mod<br> 21 -a always,exit -F arch=b32 -S chmod -S fchmod -S fchmodat -F auid=0 -k perm_mod<br> 22 -a always,exit -F arch=b32 -S chmod -S fchmod -S fchmodat -F auid>=500 -F auid!=4294967295 -k perm_mod<br> 23 -a always,exit -F arch=b32 -S chown -F auid=0 -k perm_mod<br> 24 -a always,exit -F arch=b32 -S chown -F auid>=500 -F auid!=4294967295 -k perm_mod<br> 25 -a always,exit -F arch=b32 -S chown -S fchown -S fchownat -S lchown -F auid=0 -k perm_mod<br> 26 -a always,exit -F arch=b32 -S chown -S fchown -S fchownat -S lchown -F auid>=500 -F auid!=4294967295 -k perm_mod<br> 27 -a always,exit -F arch=b32 -S clock_settime -k time-change<br> 28 -a always,exit -F arch=b32 -S creat -S open -S openat -S open_by_handle_at -S truncate -S ftruncate -F exit=-EACCES -F auid>=500 -F auid!=4294967295 -k access<br> 29 -a always,exit -F arch=b32 -S creat -S open -S openat -S open_by_handle_at -S truncate -S ftruncate -F exit=-EPERM -F auid>=500 -F auid!=4294967295 -k access<br> 30 -a always,exit -F arch=b32 -S creat -S open -S openat -S truncate -S ftruncate -F exit=-EACCES -F auid=0 -k access<br> 31 -a always,exit -F arch=b32 -S creat -S open -S openat -S truncate -S ftruncate -F exit=-EACCES -F auid>=500 -F auid!=4294967295 -k access<br> 32 -a always,exit -F arch=b32 -S creat -S open -S openat -S truncate -S ftruncate -F exit=-EPERM -F auid=0 -k access<br> 33 -a always,exit -F arch=b32 -S creat -S open -S openat -S truncate -S ftruncate -F exit=-EPERM -F auid>=500 -F auid!=4294967295 -k access<br> 34 -a always,exit -F arch=b32 -S fchmodat -F auid=0 -k perm_mod<br> 35 -a always,exit -F arch=b32 -S fchmodat -F auid>=500 -F auid!=4294967295 -k perm_mod<br> 36 -a always,exit -F arch=b32 -S fchmod -F auid=0 -k perm_mod<br> 37 -a always,exit -F arch=b32 -S fchmod -F auid>=500 -F auid!=4294967295 -k perm_mod<br> 38 -a always,exit -F arch=b32 -S fchownat -F auid=0 -k perm_mod<br> 39 -a always,exit -F arch=b32 -S fchownat -F auid>=500 -F auid!=4294967295 -k perm_mod<br> 40 -a always,exit -F arch=b32 -S fchown -F auid=0 -k perm_mod<br> 41 -a always,exit -F arch=b32 -S fchown -F auid>=500 -F auid!=4294967295 -k perm_mod<br> 42 -a always,exit -F arch=b32 -S fremovexattr -F auid=0 -k perm_mod<br> 43 -a always,exit -F arch=b32 -S fremovexattr -F auid>=500 -F auid!=4294967295 -k perm_mod<br> 44 -a always,exit -F arch=b32 -S fsetxattr -F auid=0 -k perm_mod<br> 45 -a always,exit -F arch=b32 -S fsetxattr -F auid>=500 -F auid!=4294967295 -k perm_mod<br> 46 -a always,exit -F arch=b32 -S init_module -S delete_module -k modules<br> 47 -a always,exit -F arch=b32 -S lchown -F auid=0 -k perm_mod<br> 48 -a always,exit -F arch=b32 -S lchown -F auid>=500 -F auid!=4294967295 -k perm_mod<br> 49 -a always,exit -F arch=b32 -S lremovexattr -F auid=0 -k perm_mod<br> 50 -a always,exit -F arch=b32 -S lremovexattr -F auid>=500 -F auid!=4294967295 -k perm_mod<br> 51 -a always,exit -F arch=b32 -S lsetxattr -F auid=0 -k perm_mod<br> 52 -a always,exit -F arch=b32 -S lsetxattr -F auid>=500 -F auid!=4294967295 -k perm_mod<br> 53 -a always,exit -F arch=b32 -S mount -F auid=0 -k export<br> 54 -a always,exit -F arch=b32 -S mount -F auid>=500 -F auid!=4294967295 -k export<br> 55 -a always,exit -F arch=b32 -S removexattr -F auid=0 -k perm_mod<br> 56 -a always,exit -F arch=b32 -S removexattr -F auid>=500 -F auid!=4294967295 -k perm_mod<br> 57 -a always,exit -F arch=b32 -S rmdir -S unlink -S unlinkat -S rename -S renameat -F auid=0 -k delete<br> 58 <span style="background-color:rgb(255,0,255)">-a always,exit -F arch=b32 -S rmdir -S unlink -S unlinkat -S rename -S renameat -F auid>=500 -F auid!=4294967295 -k delete</span><br> 59 -a always,exit -F arch=b32 -S sethostname -S setdomainname -k audit_network_modifications<br> 60 -a always,exit -F arch=b32 -S sethostname -S setdomainname -k system-locale<br> 61 -a always,exit -F arch=b32 -S setxattr -F auid=0 -k perm_mod<br> 62 -a always,exit -F arch=b32 -S setxattr -F auid>=500 -F auid!=4294967295 -k perm_mod<br> 63 -a always,exit -F arch=b32 -S setxattr -S lsetxattr -S fsetxattr -S removexattr -S lremovexattr -S fremovexattr -F auid=0 -k perm_mod<br> 64 -a always,exit -F arch=b32 -S setxattr -S lsetxattr -S fsetxattr -S removexattr -S lremovexattr -S fremovexattr -F auid>=500 -F auid!=4294967295 -k perm_mod<br> 65 <span style="background-color:rgb(255,0,0)">-a always,exit -F arch=b32 -S unlink -S rmdir -S unlinkat -S rename -S renameat -F auid>=500 -F auid!=4294967295 -k delete</span><br><br></div><div>I noticed that lines 58 and 65 seem to be "duplicates" although the syntax has some elements swapped.<br></div><div><br></div><div>So, what I don't understand is why is line #58 OK, if line #65 is not? Are lines of "duplicate syntax" not legal?<br><br><br></div><div>Thanks in advance,<br clear="all"></div><div><div><div class="gmail_signature"><div dir="ltr">--------------------------<br><font size="4" color="#000099">Warron French<br><font size="4"><font size="4"><font size="4"><br></font></font></font></font></div></div></div> </div></div></div>