I am required to place the following rule into my audit configurations, but when I do auditd will stop loading rules from this particular rule forward to the end.

-a always,exit -F path= /etc/NetworkManager/ -F perm=wa -F key=system-locale

The rule immediately above it was:

-a exit,never -F dir=/usr/local/share/macrovision/storage -k exclude

If I hash out the syntax including NetworkManager all rules load, but unhashed it stops loading rules from that point to the end.

--------------------------
Warron French