Problems getting auditd set up on my server
- by Tola Odejayi
I'm trying to figure out which processes are deleting files from a specific directory, so I want to set up and run auditd on my system.
I've set up the following rule in audit.rules:
-w S unlink -S truncate -S ftruncate -a exit,always -k cache_deletion -w /home/myfolder/cache
Then I type this to start the audit daemon:
auditctl -R /etc/audit/audit.rules -e 1
But I get this error message:
Error - nested rule files not supported
Does anyone know what I am doing wrong here, and how I can resolve this?
Also, what do I have to do to get the daemon running at startup?
