From mboxrd@z Thu Jan  1 00:00:00 1970
From: Vincent Fiset <vfiset@gmail.com>
Subject: operation not supported on filtering
Date: Mon, 3 Dec 2018 12:26:39 -0500
Message-ID: <CA+P2B3bkyZfnE45jKUMxCD-6SL381EMTYNsh538KaQnpZ5EH+Q@mail.gmail.com>
Mime-Version: 1.0
Content-Type: multipart/mixed; boundary="===============1332735969220406452=="
Return-path: <linux-audit-bounces@redhat.com>
Received: from mx1.redhat.com (ext-mx04.extmail.prod.ext.phx2.redhat.com
	[10.5.110.28])
	by smtp.corp.redhat.com (Postfix) with ESMTPS id CE4C55C3FD
	for <linux-audit@redhat.com>; Mon,  3 Dec 2018 17:26:52 +0000 (UTC)
Received: from mail-yb1-f175.google.com (mail-yb1-f175.google.com
	[209.85.219.175])
	(using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits))
	(No client certificate requested)
	by mx1.redhat.com (Postfix) with ESMTPS id 9E01888317
	for <linux-audit@redhat.com>; Mon,  3 Dec 2018 17:26:51 +0000 (UTC)
Received: by mail-yb1-f175.google.com with SMTP id s8so3449778ybe.9
	for <linux-audit@redhat.com>; Mon, 03 Dec 2018 09:26:51 -0800 (PST)
List-Unsubscribe: <https://www.redhat.com/mailman/options/linux-audit>,
	<mailto:linux-audit-request@redhat.com?subject=unsubscribe>
List-Archive: <https://www.redhat.com/archives/linux-audit>
List-Post: <mailto:linux-audit@redhat.com>
List-Help: <mailto:linux-audit-request@redhat.com?subject=help>
List-Subscribe: <https://www.redhat.com/mailman/listinfo/linux-audit>,
	<mailto:linux-audit-request@redhat.com?subject=subscribe>
Sender: linux-audit-bounces@redhat.com
Errors-To: linux-audit-bounces@redhat.com
To: linux-audit@redhat.com
List-Id: linux-audit@redhat.com

--===============1332735969220406452==
Content-Type: multipart/alternative; boundary="0000000000004d4f16057c21744c"

--0000000000004d4f16057c21744c
Content-Type: text/plain; charset="UTF-8"

I got a minimal audit.rules file containing:

    # cat -n /etc/audit/audit.rules
    1  -D
    2
    3  -b 8192
    4
    5  -e 0
    6
    7  -a always,exclude -F msgtype=CWD
    8
    9  -w /etc/sysctl.conf -p wa -k sysctl

When I restart auditd I get:

    # /etc/init.d/auditd restart
    Restarting audit daemon: auditd Error sending add rule request
(Operation not supported)
    There was an error in line 7 of /etc/audit/audit.rules
     failed!

instructions like `-a always,exclude -F msgtype=CWD` seems to be very
popular in example all over the internet. I don't understand why I get the
error.

I use auditd `1:1.7.18-1.1` on debian 7

What should I do to make this filter work?

-- 
/VF

--0000000000004d4f16057c21744c
Content-Type: text/html; charset="UTF-8"
Content-Transfer-Encoding: quoted-printable

<div dir=3D"ltr"><div dir=3D"ltr"><div>I got a minimal audit.rules file con=
taining:</div><div><br></div><div>=C2=A0 =C2=A0 # cat -n /etc/audit/audit.r=
ules</div><div>=C2=A0 =C2=A0 1=C2=A0 -D</div><div>=C2=A0 =C2=A0 2</div><div=
>=C2=A0 =C2=A0 3=C2=A0 -b 8192</div><div>=C2=A0 =C2=A0 4</div><div>=C2=A0 =
=C2=A0 5=C2=A0 -e 0</div><div>=C2=A0 =C2=A0 6</div><div>=C2=A0 =C2=A0 7=C2=
=A0 -a always,exclude -F msgtype=3DCWD</div><div>=C2=A0 =C2=A0 8</div><div>=
=C2=A0 =C2=A0 9=C2=A0 -w /etc/sysctl.conf -p wa -k sysctl</div><div><br></d=
iv><div>When I restart auditd I get:</div><div><br></div><div>=C2=A0 =C2=A0=
 # /etc/init.d/auditd restart</div><div>=C2=A0 =C2=A0 Restarting audit daem=
on: auditd Error sending add rule request (Operation not supported)</div><d=
iv>=C2=A0 =C2=A0 There was an error in line 7 of /etc/audit/audit.rules</di=
v><div>=C2=A0 =C2=A0 =C2=A0failed!</div><div><br></div><div>instructions li=
ke `-a always,exclude -F msgtype=3DCWD` seems to be very popular in example=
 all over the internet. I don&#39;t understand why I get the error.</div><d=
iv><br></div><div>I use auditd `1:1.7.18-1.1` on debian 7=C2=A0</div><div><=
br></div><div>What should I do to make this filter work?</div><div><br></di=
v>-- <br><div dir=3D"ltr" class=3D"gmail_signature"><div dir=3D"ltr">/VF</d=
iv></div></div></div>

--0000000000004d4f16057c21744c--


--===============1332735969220406452==
Content-Type: text/plain; charset="us-ascii"
MIME-Version: 1.0
Content-Transfer-Encoding: 7bit
Content-Disposition: inline


--===============1332735969220406452==--