up vote 1 down vote favorite
share [g+] share [fb]

I am setting audit rules in /etc/audit/audit.rules.

As the requirement : The audit system should be configured to audit all administrative, privileged, and security actions.

So I add one line into /etc/audit/auditd.rules:

-a exit,always -S stime -S acct -S reboot -S swapon

However, after I restart audit.d by service auditd restart:

There is error comeout:
Stopping auditd:                                           [  OK  ]
Starting auditd:                                           [  OK  ]
Syscall name unknown: stime
There was an error in line 14 of /etc/audit/audit.rules

It seems stime can't be recognized. Could anybody help me to find out what is wrong with my added rule? Thanks a lot!

link|improve this question
88% accept rate
feedback

2 Answers

up vote 2 down vote

By chance are you running 64 bit? You might need to qualify the architecture.

So -a exit,always -F arch=b32 -S stime

Let me know.

link|improve this answer
Don't forget you can check if an audit is in a certain architecture by running the ausyscall stime x86_64 OR ausyscall stime i686 – Jason Apr 6 at 21:01
feedback
up vote 0 down vote

Shouldn't you add this to /etc/audit/audit.rules instead?

link|improve this answer
I'm sorry, in fact, I add it into /etc/audit/audit.rules. But I didn't say clearly in the question. – zhaojing Sep 10 '10 at 8:21
feedback

Your Answer

 
or
required, but never shown
discard

Not the answer you're looking for? Browse other questions tagged or ask your own question.