<div dir="rtl"><div style="text-align:left" dir="ltr">I found the following bug:<br><br><br></div><div style="text-align:left">OS version = Red Hat Enterprise Linux release 8.6 (Ootpa)</div><div style="text-align:left">Kernel version = 4.18.0-425.3.1.el8.x86_64</div><div style="text-align:left">auditctl version = 3.0.7</div><div style="text-align:left"><br></div><div style="text-align:left">Scenario 1:</div><div style="text-align:left">When I load the configurations :</div><div style="text-align:left"><b>auditctl -a always,exit -S all -F dir=/ -F perm=w -F success=1</b></div><div style="text-align:left">And run the command:</div><div style="text-align:left"><b>cp /tmp/1  /tmp/2</b></div><div style="text-align:left">No new log is created in: /var/log/audit/audit.log</div><div style="text-align:left">But the file is indeed copied.</div><div style="text-align:left"><br></div><div style="text-align:left">Scenario 2:</div><div style="text-align:left">When I load the configurations :</div><div style="text-align:left"><b>auditctl -a always,exit -S all -F dir=/ -F perm=w -F success=0</b></div><div style="text-align:left">And run the command:</div><div style="text-align:left"><b>cp /tmp/1  /tmp/2</b></div><div style="text-align:left">No new log is created in: /var/log/audit/audit.log</div><div style="text-align:left">But the file is indeed copied.</div><div style="text-align:left"><br></div><div style="text-align:left">Scenario 3:</div><div style="text-align:left">When I load the configurations :</div><div style="text-align:left"><b>auditctl -a always,exit -S all -F dir=/ -F perm=w</b></div><div style="text-align:left">And run the command:</div><div style="text-align:left"><b>cp /tmp/1  /tmp/2</b></div><div style="text-align:left">Yes new log is created in: /var/log/audit/audit.log</div><div style="text-align:left">File was indeed copied.</div><div style="text-align:left"><br></div><div style="text-align:left">Conclusion:</div><div style="text-align:left">Only when I don't use the -F success  new logs are created.</div><div style="text-align:left">Why is that?</div><div style="text-align:left">Any alternative ?</div></div>