RHEL 4 /etc/audit.rules

matonb · 06-01-2010, 06:32 AM

Hi Guys,

Does anyone know where the auditd / audit.rules documentation is for RHEL4 ?

Thanks

TB0ne · 06-01-2010, 09:45 AM

Quote:

Originally Posted by matonb

Hi Guys,

Does anyone know where the auditd / audit.rules documentation is for RHEL4 ?

Thanks

You can (as root), run "find / -name audit.rules" or "locate audit.rules", and it'll tell you where the file is. Also, since you're using RedHat Enterprise, you can call RedHat support, since you're paying for it.

matonb · 06-04-2010, 03:41 AM

Wow, that's so helpful

DrLove73 · 06-04-2010, 03:51 AM

You have read all of the:

man audit.rules
man auditctl
man auditd
/usr/share/doc/audit-*
auditd.conf(5)
ausearch(8)

?

There is a little snipet here: http://www.redhat.com/docs/manuals/e...x86_64-en.html

I can not see anything else, maybe in some books?

TB0ne · 06-04-2010, 08:02 AM

Quote:

Originally Posted by matonb

Wow, that's so helpful

You asked where the files were, I told you how to find them. Don't give a snotty reply, if you don't like the answers you get.

And if you're REALLY wanting support, call RedHat...you're using RHEL, so you're paying for support, use it. If you wanted the docs, typing in "man <command>" is a good start. And did you bother to look in the RedHat knowledgebase, or on Google??? Easily found there...

DrLove73 · 06-04-2010, 11:24 AM

Quote:

Originally Posted by TB0ne

You asked where the files were, I told you how to find them. Don't give a snotty reply, if you don't like the answers you get.

And if you're REALLY wanting support, call RedHat...you're using RHEL, so you're paying for support, use it. If you wanted the docs, typing in "man <command>" is a good start. And did you bother to look in the RedHat knowledgebase, or on Google??? Easily found there...

Actually, he asked where DOCUMENTATION on audit for RHEL 4 is. You misunderstood him and gave the wrong answer.

TB0ne · 06-04-2010, 04:11 PM

Quote:

Originally Posted by DrLove73

Actually, he asked where DOCUMENTATION on audit for RHEL 4 is. You misunderstood him and gave the wrong answer.

Quite true, and upon further reading you're right.

Still no reason to be snotty.

matonb · 06-05-2010, 05:28 AM

Quote:

Originally Posted by DrLove73

You have read all of the:

man audit.rules
man auditctl
man auditd
/usr/share/doc/audit-*
auditd.conf(5)
ausearch(8)

?

There is a little snipet here: http://www.redhat.com/docs/manuals/e...x86_64-en.html

I can not see anything else, maybe in some books?

Thanks DrLove, I did find it in the end. Trawling the RH Documentation on RHEL4 wasn't giving much joy but I eventually came across a thread on another forum that pointed me to the right man page.

DrLove73 · 06-05-2010, 05:25 PM

I suggest you post that link here for others who might need it, and then MARK this thread as SOLVED, as per instructions in my signature. Thanks.

idlehands · 06-25-2010, 12:07 PM

Found this thread on google and don't see the link request. boooo hissss