Server Fault is a question and answer site for system and network administrators. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I am setting audit rules in /etc/audit/audit.rules.

As the requirement : The audit system should be configured to audit all administrative, privileged, and security actions.

So I add one line into /etc/audit/auditd.rules:

-a exit,always -S stime -S acct -S reboot -S swapon

However, after I restart audit.d by service auditd restart:

There is error comeout:
Stopping auditd:                                           [  OK  ]
Starting auditd:                                           [  OK  ]
Syscall name unknown: stime
There was an error in line 14 of /etc/audit/audit.rules

It seems stime can't be recognized. Could anybody help me to find out what is wrong with my added rule? Thanks a lot!

share|improve this question

By chance are you running 64 bit? You might need to qualify the architecture.

So -a exit,always -F arch=b32 -S stime

Let me know.

share|improve this answer
Don't forget you can check if an audit is in a certain architecture by running the ausyscall stime x86_64 OR ausyscall stime i686 – Jason Apr 6 '12 at 21:01

Shouldn't you add this to /etc/audit/audit.rules instead?

share|improve this answer
I'm sorry, in fact, I add it into /etc/audit/audit.rules. But I didn't say clearly in the question. – zhaojing Sep 10 '10 at 8:21

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.