On Mon, 2005-08-01 at 20:26 +0200, Vassilios Kotoulas wrote: > hi, > > when auditd starts on boot I get an error message about a syntax error > in /etc/audit.rules in line 5 > > this is the file: > > # This file contains the auditctl rules that are loaded > # whenever the audit daemon is started via the initscripts. > # > # First rule - delete all > -D > # > # Feel free to add below this line. See auditctl man page > # > # Increase the buffers to survive stress events > -b 256 > > > I can't find -D in the auditctl(8). Is it a remain from fc3? I did an > update fc3 -> fc4 some days ago. How must the first rule look now? It's fine. Have you applied all updates? Are you not running SELinux in enforcing mode? See: https://bugzilla.redhat.com/bugzilla/show_bug.cgi?id=163223 Paul. -- Paul Howarth <paul@xxxxxxxxxxxx>
