<div dir="ltr">
<span style="color:rgb(34,34,34);font-family:arial,sans-serif;font-size:12.8px;font-style:normal;font-variant-ligatures:normal;font-variant-caps:normal;font-weight:400;letter-spacing:normal;text-align:start;text-indent:0px;text-transform:none;white-space:normal;word-spacing:0px;background-color:rgb(255,255,255);text-decoration-style:initial;text-decoration-color:initial;float:none;display:inline">Mr. Briggs/Rafi,</span><div style="color:rgb(34,34,34);font-family:arial,sans-serif;font-size:12.8px;font-style:normal;font-variant-ligatures:normal;font-variant-caps:normal;font-weight:400;letter-spacing:normal;text-align:start;text-indent:0px;text-transform:none;white-space:normal;word-spacing:0px;background-color:rgb(255,255,255);text-decoration-style:initial;text-decoration-color:initial"><br></div><div style="color:rgb(34,34,34);font-family:arial,sans-serif;font-size:12.8px;font-style:normal;font-variant-ligatures:normal;font-variant-caps:normal;font-weight:400;letter-spacing:normal;text-align:start;text-indent:0px;text-transform:none;white-space:normal;word-spacing:0px;background-color:rgb(255,255,255);text-decoration-style:initial;text-decoration-color:initial">I don't see the -i switch even mentioned in the manpage for audit.rules. Is this a documented switch, or not yet a capability on Red Hat or CentOS systems?</div><div style="color:rgb(34,34,34);font-family:arial,sans-serif;font-size:12.8px;font-style:normal;font-variant-ligatures:normal;font-variant-caps:normal;font-weight:400;letter-spacing:normal;text-align:start;text-indent:0px;text-transform:none;white-space:normal;word-spacing:0px;background-color:rgb(255,255,255);text-decoration-style:initial;text-decoration-color:initial"><br></div><div style="color:rgb(34,34,34);font-family:arial,sans-serif;font-size:12.8px;font-style:normal;font-variant-ligatures:normal;font-variant-caps:normal;font-weight:400;letter-spacing:normal;text-align:start;text-indent:0px;text-transform:none;white-space:normal;word-spacing:0px;background-color:rgb(255,255,255);text-decoration-style:initial;text-decoration-color:initial">Thanks in advance,</div>
<br></div><div class="gmail_extra"><br clear="all"><div><div class="gmail_signature" data-smartmail="gmail_signature"><div dir="ltr">--------------------------<br><font color="#000099" size="4">Warron French<br><font size="4"><font size="4"><font size="4"><br></font></font></font></font></div></div></div>
<br><div class="gmail_quote">On Tue, Apr 24, 2018 at 6:31 PM, Richard Guy Briggs <span dir="ltr"><<a href="mailto:rgb@redhat.com" target="_blank">rgb@redhat.com</a>></span> wrote:<br><blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex">On 2018-04-24 18:03, warron.french wrote:<br>
> Mr. Briggs/Rafi,<br>
<br>
I think you forgot to reply to the list (preferred) and/or Rafi.<br>
<div class="HOEnZb"><div class="h5"><br>
> I don't see the -i switch even mentioned in the manpage for audit.rules.<br>
> Is this a documented switch, or not yet a capability on Red Hat or CentOS<br>
> systems?<br>
> <br>
> Thanks in advance,<br>
> <br>
> --------------------------<br>
> Warron French<br>
> <br>
> <br>
> On Tue, Apr 24, 2018 at 11:14 AM, Richard Guy Briggs <<a href="mailto:rgb@redhat.com">rgb@redhat.com</a>> wrote:<br>
> <br>
> > On 2018-04-23 23:41, F Rafi wrote:<br>
> > > Adding a -i to the rules file should ignore any errors.<br>
> ><br>
> > At risk of feature creep, it might be nice to have a flag to ignore<br>
> > certain rules but not others, a way to tag individual rules with either<br>
> > a must, or a different tag with "ignore if not present" for file rules.<br>
> ><br>
> > > -Farhan<br>
> > ><br>
> > > On Mon, Apr 23, 2018 at 9:19 PM, warron.french <<a href="mailto:warron.french@gmail.com">warron.french@gmail.com</a>><br>
> > wrote:<br>
> > > > Hi, I have a requirement to monitor a ton of files, executables and<br>
> > confug<br>
> > > > files.<br>
> > > ><br>
> > > > Anyway, not all of my systems have every file in the list; and when I<br>
> > add<br>
> > > > the rules appropriate, either as a Watch (-w) rule or as an Action (-a)<br>
> > > > rule, the rules stop loading when the find a rule that has a file that<br>
> > > > doesn't exist *on that particular system*.<br>
> > > ><br>
> > > > This is the intended effect, yes?<br>
> > > ><br>
> > > > Thanks in advance,<br>
> > > > --------------------------<br>
> > > > Warron French<br>
> ><br>
> > - RGB<br>
> ><br>
> > --<br>
> > Richard Guy Briggs <<a href="mailto:rgb@redhat.com">rgb@redhat.com</a>><br>
> > Sr. S/W Engineer, Kernel Security, Base Operating Systems<br>
> > Remote, Ottawa, Red Hat Canada<br>
> > IRC: rgb, SunRaycer<br>
> > Voice: +1.647.777.2635, Internal: (81) 32635<br>
> ><br>
<br>
- RGB<br>
<br>
--<br>
Richard Guy Briggs <<a href="mailto:rgb@redhat.com">rgb@redhat.com</a>><br>
Sr. S/W Engineer, Kernel Security, Base Operating Systems<br>
Remote, Ottawa, Red Hat Canada<br>
IRC: rgb, SunRaycer<br>
Voice: +1.647.777.2635, Internal: (81) 32635<br>
</div></div></blockquote></div><br></div>