Problems getting auditd set up on my server

Posted by Tola Odejayi on Server Fault See other posts from Server Fault or by Tola Odejayi
Published on 2012-09-28T16:05:06Z Indexed on 2012/09/28 21:39 UTC
Read the original article Hit count: 256

Filed under:

auditd

I'm trying to figure out which processes are deleting files from a specific directory, so I want to set up and run auditd on my system.

I've set up the following rule in audit.rules:

-w S unlink -S truncate -S ftruncate -a exit,always -k cache_deletion -w /home/myfolder/cache

Then I type this to start the audit daemon:

auditctl -R /etc/audit/audit.rules -e 1

But I get this error message:

Error - nested rule files not supported

Does anyone know what I am doing wrong here, and how I can resolve this?

Also, what do I have to do to get the daemon running at startup?

Related posts about auditd

Suggestion for auditd set-up

as seen on Server Fault - Search for 'Server Fault'
Hi, I am trying to learn about securing a Linux box (I am using Ubuntu). Auditd is recommended for monitoring activities on the node. I have managed to install it, but I can't find much information about proper set-up to secure my node. How should I set-up auditd to make my node more secure? What… >>> More
Problems getting auditd set up on my server

as seen on Server Fault - Search for 'Server Fault'
I'm trying to figure out which processes are deleting files from a specific directory, so I want to set up and run auditd on my system. I've set up the following rule in audit.rules: -w S unlink -S truncate -S ftruncate -a exit,always -k cache_deletion -w /home/myfolder/cache Then I type this to… >>> More
difference between success and failed event in auditd/aureport

as seen on Server Fault - Search for 'Server Fault'
The aureport command has two options that limit the list of displayed events to those that were successful and those that failed. Per the man page: --failed Only select failed events for processing in the reports. The default is both success and failed events. --success … >>> More
Unable to start auditd

as seen on Server Fault - Search for 'Server Fault'
I am on CentOS 5.8 final I recently installed auditd via yum install audit however I am unable to start it. I edited the configuration file to give a verbose output of the error it is recieving in starting up and this is the output: # service auditd start Starting auditd: Config file /etc/audit/auditd… >>> More
Trying to make changes to the size of the events buffer in prelude-ids auditd plugin

as seen on Server Fault - Search for 'Server Fault'
I am running systems using the prelude-ids plugin for auditd. When the manager is up every thing works fine however I have a requirement that when the clients can't talk to the manager they should store no more than 250MB of messages, and when they hit that point they should start deleting the oldest… >>> More

Developer IT