[RFC][PATCH] (#6) filesystem auditing

[Timothy R. Chavez]

Hmmm,

I'm getting this now too:

./auditctl -w /audit/foo

Error sending netlink packet (Connection refused)

Error sending rule to kernel

./auditd -f

Config file /etc/auditd.conf opened for parsing
log_file_parser called with: /var/log/audit.log
log_format_parser called with: RAW
flush_parser called with: DATA
freq_parser called with: 0
num_logs_parser called with: 5
max_log_size_parser called with: 10
max_log_size_action_parser called with: ROTATE
space_left_parser called with: 75
space_action_parser called with: SYSLOG
admin_space_left_parser called with: 50
admin_space_left_action_parser called with: SUSPEND
disk_full_action_parser called with: SUSPEND
type=DAEMON msg=auditd(1110908991) auditd start, format=raw, pid=9805, uid=0
Error sending netlink packet (Connection refused)

type=DAEMON msg=auditd(1110908991) auditd error halt, pid=9805, uid=0
Unable to set audit pid, exiting
The audit daemon is exiting.
Error sending netlink packet (Connection refused)


This is strange, let me investigate.

-tim