At the top of
/etc/audit/audit.rules on Centos7 it tells me:
## This file is automatically generated from /etc/audit/rules.d
Okay, so I went and looked, and found
/etc/audit/rules.d/audit.rules. It had the following line
# Feel free to add below this line. See auditctl man page
Which I did, and found what looked like maybe it was the option:
-R file Read rules from a file. The rules must be 1 per line and in the order that they are to be executed in. The rule file must be owned by root and not readable by other users or it will be rejected. The rule file may have comments embedded by starting the line with a '#' character. Rules that are read from a file are identical to what you would type on a command line except they are not preceded by auditctl (since auditctl is the one executing the file) and you would not use shell escaping since auditctl is reading the file instead of bash.
But I ran
auditctl -R /etc/audit/rules.d/audit.rules which seemed to work, however it didn't do anything to
What's the right way to regenerate that file?