Sample auditd warning message:
WARNING - 32/64 bit syscall mismatch in line 14, you should specify an arch
Sample audit.rules line in question:
-a entry,always -S umask
Solution: add "-F arch=64" - without the quotes- before the -S for the line to read like this:
-a entry,always -F arch=b64 -S umask
No comments:
Post a Comment