<html> <head> <meta http-equiv="Content-Type" content="text/html; charset=UTF-8"> </head> <body> On 3/16/21 8:46 PM, Richard Guy Briggs wrote: <blockquote type="cite" cite="mid:20210317014653.GT986374@madcap2.tricolour.ca"> <blockquote type="cite" style="color: #007cff;"> <pre class="moz-quote-pre" wrap=""> I have run some simple commands in /data that should be logged , e.g. touch file, mkdir dir. Finally, I have run auditctl-s and expected to see the backlog events counter go up, but it's still 0. If I start auditd again, the events are never logged. Am I missing something here? </pre> </blockquote> <pre class="moz-quote-pre" wrap="">So, since you haven't indicated if you have tried and tested this already, please start by running those simple commands while the auditd service is running and verifying that those commands do get logged as expected. If they don't, fix that first.</pre> </blockquote> I was wondering if the events are delivered to syslog (/var/log/messages) instead while the auditd is down? Mine are, same kernel version 3.10.0. From the kernel perspective, no backlog?. However, if I stop both audit and rsyslog, add some events the backlog count doesn't increase and I can't see where the events may have been delivered. LCB <pre class="moz-signature" cols="72">-- Lenny Bruzenak MagitekLTD</pre> </body> </html>