Server Fault is a question and answer site for system and network administrators. It's 100% free, no registration required.

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I'm trying to figure out which processes are deleting files from a specific directory, so I want to set up and run auditd on my system.

I've set up the following rule in audit.rules:

-w S unlink -S truncate -S ftruncate -a exit,always -k cache_deletion -w /home/myfolder/cache

Then I type this to start the audit daemon:

auditctl -R /etc/audit/audit.rules -e 1

But I get this error message:

Error - nested rule files not supported

Does anyone know what I am doing wrong here, and how I can resolve this?

Also, what do I have to do to get the daemon running at startup?

share|improve this question

That rule is trying to define two paths to audit, -w S and -w /home/myfolder/cache. You can only use -p and -k options with -w too.

Try the following rule:

-a exit,always -S unlinkat -S truncate -S ftruncate -F dir=/home/myfolder/cache -F key=cache_deletion

...or for simplicity's sake:

-w /home/myfolder/cache -k cache_deletion -p wa

To start the service at startup:

/sbin/chkconfig auditd on
share|improve this answer
Thanks for replying, skohrs. Unfortunately, that didn't work - it returned the same error about 'nested rule files'. – Tola Odejayi Sep 28 '12 at 19:37
Did you see my updated rule? I had a typo. Is this the only rule in /etc/audit/audit.rules? In my testing, I had to use the 'unlinkat' system call to detect the file being removed. – skohrs Sep 28 '12 at 19:53
I tried your suggestion, but now I get the following error: The audit system is disabled. I tried adding -e 1 to the line in /etc/audit/audit.trail, but it still makes no difference. – Tola Odejayi Sep 29 '12 at 3:36
@TolaOdejayi to enable auditing (with auditd running) just run auditctl -e (alone, by itself). – voretaq7 Nov 6 '12 at 3:42
@voretaq7 No, that would fail. It needs a second parameter, the type of flag (0-silent, 1-print, 2-panic). – Christian Jan 3 '13 at 11:34
up vote -2 down vote accepted

In the end, I gave up on trying to do this because I was able to identify (through some other means) some code which causing the deletes to occur.

share|improve this answer
Just saw this. Downvoted because I found another way to do this? Some people need to get out more. – Tola Odejayi Oct 31 '14 at 4:38

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.