problem of setting audit rules: Syscall name unknown: stime
- by zhaojing
I am setting audit rules in /etc/audit/audit.rules.
As the requirement : The audit system should be configured to audit all administrative, privileged, and security actions.
So I add one line into /etc/audit/auditd.rules:
-a exit,always -S stime -S acct -S reboot -S swapon
However, after I restart audit.d by service auditd restart:
There is error comeout:
Stopping auditd: [ OK ]
Starting auditd: [ OK ]
Syscall name unknown: stime
There was an error in line 14 of /etc/audit/audit.rules
It seems stime can't be recognized.
Could anybody help me to find out what is wrong with my added rule? Thanks a lot!