I am setting audit rules in /etc/audit/audit.rules.
As the requirement : The audit system should be configured to audit all administrative, privileged, and security actions.
So I add one line into /etc/audit/auditd.rules:
-a exit,always -S stime -S acct -S reboot -S swapon
However, after I restart audit.d by service auditd restart:
There is error comeout: Stopping auditd: [ OK ] Starting auditd: [ OK ] Syscall name unknown: stime There was an error in line 14 of /etc/audit/audit.rules
It seems stime can't be recognized. Could anybody help me to find out what is wrong with my added rule? Thanks a lot!