On Thu, 2005-07-14 at 09:27 +0200, Eric Tanguy wrote: > Le jeudi 14 juillet 2005 à 08:11 +0100, Paul Howarth a écrit : > > On Thu, 2005-07-14 at 00:17 +0200, Eric Tanguy wrote: > > > Le mercredi 13 juillet 2005 à 19:04 +0100, Paul Howarth a écrit : > > > > On Wed, 2005-07-13 at 18:14 +0200, Eric Tanguy wrote: > > > > > Since i updated audit this morning i have an error : error line 5 > > > > > in /etc/audit.rules at boot. This what i remember to have read on the > > > > > screen because i can find this error neither in /var/log/messages > > > > > nor /var/log/audit/audit.log > > > > > > > > So what are the first 10 lines of /etc/audit.rules on your system? > > > > > > > > And have you looked at "man auditctl" to see if you can figure out what > > > > the error is? > > > > > > > here is my /etc/audit.rules : > > > # This file contains the auditctl rules that are loaded > > > # whenever the audit daemon is started via the initscripts. > > > > > > # First rule - delete all > > > -D > > > > > > # Feel free to add below this line. See auditctl man page > > > > > > # Increase the buffers to survive stress events > > > -b 256 > > > > > > It seems that -D would be -d. > > > > This looks the same as mine. Does the syntax error message reappear if > > you do "service auditd restart"? > > > > Paul. > > -- > > Paul Howarth <paul@xxxxxxxxxxxx> > > > yes : > [tanguy@bureau ~]$ sudo service auditd restart > Password: > Arrêt de auditd : [ OK ] > Error sending list request (Invalid argument) > Error sending list request (Invalid argument) > Démarrage de auditd : [ OK ] > Error sending list request (Invalid argument) > Error sending list request (Invalid argument) > There was an error in line 5 of /etc/audit.rules > [tanguy@bureau ~]$ I'm getting this too now. Looks like the updated audit package may be broken. I've raised a bugzilla ticket: https://bugzilla.redhat.com/bugzilla/show_bug.cgi?id=163223 Note that this "error" does not stop auditd from starting (at least not here). I think the issue may actually be a side effect of https://bugzilla.redhat.com/bugzilla/show_bug.cgi?id=161322, which the initscript does appear to try to mask, apparently unsuccessfully. Paul. -- Paul Howarth <paul@xxxxxxxxxxxx>
