<html><head></head><body><div class="ydp9dea18eeyahoo-style-wrap" style="font-family:Helvetica Neue, Helvetica, Arial, sans-serif;font-size:16px;"><div id="ydp9dea18eeyiv3417228079"><div><div class="ydp9dea18eeyiv3417228079ydpab62505dyahoo-style-wrap" style="font-family:Helvetica Neue, Helvetica, Arial, sans-serif;font-size:16px;"><div dir="ltr">1. The rules for monitoring '/etc/passwd', '/etc/shadow', '/etc/group', '/etc/gshadow' exist. Shouldn't corresponding rules also exist for the same four files which also have a dash/hyphen appended to them (i.e. '/etc/passwd-', etc...)?</div><div dir="ltr"><br></div><div dir="ltr">2. By adding 'audit=1' to grub kernel boot param's---can I then safely eliminate this piece from all audit rules: <span>'-F auid!=4294967295'?</span></div><div dir="ltr"><span>Conversely, what harm would it do to 'just leave it'? It would, in some cases, satisfy certain vulnerability scanning tools seeking exact syntax compliance, right?<br></span></div><div dir="ltr"><span><br></span></div><div dir="ltr" data-setdir="false"><span>Thank you.</span></div><div dir="ltr" data-setdir="false"><span><br></span></div><div dir="ltr" data-setdir="false"><span>R,</span></div><div dir="ltr" data-setdir="false"><span>-Joe Wulf</span><br></div><div><br></div><div><br></div><div><br></div></div></div></div></div></body></html>