Bad Rule?

[warron.french]

I am required to place the following rule into my audit configurations, but
when I do auditd will stop loading rules from this particular rule forward
to the end.

-a always,exit  -F path= /etc/NetworkManager/  -F perm=wa  -F
key=system-locale

The rule immediately above it was:
-a  exit,never -F dir=/usr/local/share/macrovision/storage -k exclude

If I hash out the syntax including NetworkManager all rules load, but
unhashed it stops loading rules from that point to the end.



--------------------------
Warron French
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://listman.redhat.com/archives/linux-audit/attachments/20210708/96d60746/attachment.htm>