Linux Archive

Linux Archive (http://www.linux-archive.org/)
-   Red Hat Linux (http://www.linux-archive.org/red-hat-linux/)
-   -   audit.rules umount problem (http://www.linux-archive.org/red-hat-linux/474283-audit-rules-umount-problem.html)

"Mr. Paul M. Whitney" 01-09-2011 02:18 PM

audit.rules umount problem
 
I am trying to add rules that audit umount/umount2. My entries are:

<from audit.rules>

-a always,exit -F arch=b32 -S umount -F auid>=500 -F auid!=4294967295 -k umount

# This line with 64 generates and error in the rules.
-a always,exit -F arch=b64 -S umount -F auid>=500 -F auid!=4294967295 -k umount

# These next two appear to be ok
-a always,exit -F arch=b32 -S umount2 -F auid>=500 -F auid!=4294967295 -k umount
-a always,exit -F arch=b64 -S umount2 -F auid>=500 -F auid!=4294967295 -k umount

< end audit.rules>

Can some please tell me why this line is generating and error and possibly a solution?

Thank you,

Paul

--
redhat-list mailing list
unsubscribe mailto:redhat-list-request@redhat.com?subject=unsubscribe
https://www.redhat.com/mailman/listinfo/redhat-list


All times are GMT. The time now is 07:53 AM.

VBulletin, Copyright ©2000 - 2014, Jelsoft Enterprises Ltd.
Content Relevant URLs by vBSEO ©2007, Crawlability, Inc.