Failure flag "0" doesn't work

[Burn Alting]

Alex,

Can you provide a little more detail?

Perhaps your /etc/audit/auditd.conf, /etc/audit/rules.d/*, your test
case, the expected outcome and the outcome you actually get.

Regards

On Thu, 2015-08-20 at 11:09 +0300, Alex Beljanski wrote:
> Hi!
> 
> 
> We have problem in CentOS 7 with auditd.
> 
> For our servers we set failure flag 0, but kernel write messages and
> we see them in dmesg.
> 
> uname -a
> Linux 3.10.0-229.11.1.el7.x86_64 #1 SMP Thu Aug 6 01:06:18 UTC 2015
> x86_64 x86_64 x86_64 GNU/Linux
> 
> # rpm -qa | grep audit
> audit-2.4.1-5.el7.x86_64
> 
> 
> Why this doesn't work?
> 
> 
> 
> 
> 
> --
> Linux-audit mailing list
> Linux-audit at redhat.com
> https://www.redhat.com/mailman/listinfo/linux-audit