I was having the same difficulty. The documentation is extremely sparse. I recommened the following...
'man audit-filter.conf' (not filter.conf as the /etc/audit/filter.conf file suggests...it's a typo) and the documents in '/usr/share/doc/eal3-certification-doc-1.1'. That's the only documentation I know of. I even searched the author's site for more info, but nothing was available.
|