FS#36823 - [audit] service not working,

Attached to Project: Community Packages
Opened by RbN (RbN) - Saturday, 07 September 2013, 19:53 GMT
Last edited by Massimiliano Torromeo (mtorromeo) - Monday, 09 September 2013, 17:00 GMT
Task Type Bug Report
Category Packages
Status Closed
Assigned To Massimiliano Torromeo (mtorromeo)
Architecture All
Severity High
Priority Normal
Reported Version
Due in Version Undecided
Due Date Undecided
Percent Complete 100%
Votes 0
Private No

Details

Description :
Since last update, the location of the file containing the rules changed from
/etc/audit/
to
/etc/audit/rules.d/

Solution :
The systemd's service file must be changed to match the new behavior :
ExecStartPost=-/usr/bin/auditctl -R /etc/audit/rules.d/audit.rules
This task depends upon

Closed by  Massimiliano Torromeo (mtorromeo)
Monday, 09 September 2013, 17:00 GMT
Reason for closing:  Not a bug
Comment by Massimiliano Torromeo (mtorromeo) - Monday, 09 September 2013, 09:22 GMT
The behavior of the service is described in its unit /usr/lib/systemd/system/auditd.service:

## To use augenrules, copy this file to /etc/systemd/system/auditd.service
## and uncomment the next line and delete/comment out the auditctl line.
## Then copy existing rules to /etc/audit/rules.d/
## Not doing this last step can cause loss of existing rules
#ExecStartPost=-/usr/bin/augenrules --load

The location of the rules file did not change. You can still use the /etc/audit/audit.rules file as before without changing anything or use the /etc/audit/rules.d/ directory and follow the above instructions. The service file is provided by the upstream project.
Comment by RbN (RbN) - Monday, 09 September 2013, 16:57 GMT
Outch, you're right, sorry for the noise.

Anyway, why the audit.rules file was pacsaved during last update ?
That confused me.
Comment by Massimiliano Torromeo (mtorromeo) - Monday, 09 September 2013, 16:58 GMT
Since it is not provided anymore by default in the package, it was removed from the files tracked by pacman, which has this side-effect.

Loading...