problem of setting audit rules: Syscall name unknown: stime
- by zhaojing
I am setting audit rules in /etc/audit/audit.rules.
As the requirement : The audit system should be configured to audit all administrative, privileged, and security actions.
So I add one line into /etc/audit/auditd.rules:
-a exit,always -S stime -S acct -S reboot -S swapon
However, after I restart audit.d by service auditd restart:
There is…