Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

I am setting audit rules in /etc/audit/audit.rules.

As the requirement : The audit system should be configured to audit all administrative, privileged, and security actions.

So I add one line into /etc/audit/auditd.rules:

-a exit,always -S stime -S acct -S reboot -S swapon

However, after I restart audit.d by service auditd restart:

There is error comeout:
Stopping auditd:                                           [  OK  ]
Starting auditd:                                           [  OK  ]
Syscall name unknown: stime
There was an error in line 14 of /etc/audit/audit.rules

It seems stime can't be recognized. Could anybody help me to find out what is wrong with my added rule? Thanks a lot!

share|improve this question
add comment

2 Answers

By chance are you running 64 bit? You might need to qualify the architecture.

So -a exit,always -F arch=b32 -S stime

Let me know.

share|improve this answer
    
Don't forget you can check if an audit is in a certain architecture by running the ausyscall stime x86_64 OR ausyscall stime i686 –  Jason Apr 6 '12 at 21:01
add comment

Shouldn't you add this to /etc/audit/audit.rules instead?

share|improve this answer
    
I'm sorry, in fact, I add it into /etc/audit/audit.rules. But I didn't say clearly in the question. –  zhaojing Sep 10 '10 at 8:21
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.