Centos – When does augenrules run automatically on CentOS 7.1

auditauditdcentoscentos7

I need to update /etc/audit/audit.rules. I would replace the file restart the service, but I found in the log a call to augenrules during initial startup of the machine.

Apart from the initial startup, is there any time when augenrules runs automatically?

Best Answer

The answer is in /etc/systemd/system/multi-user.target.wants/auditd.service

[Service]
ExecStart=/sbin/auditd -n
## To not use augenrules, copy this file to /etc/systemd/system/auditd.service
## and comment/delete the next line and uncomment the auditctl line.
## NOTE: augenrules expect any rules to be added to /etc/audit/rules.d/
ExecStartPost=-/sbin/augenrules --load
#ExecStartPost=-/sbin/auditctl -R /etc/audit/audit.rules
ExecReload=/bin/kill -HUP $MAINPID

So starting the service calls augenrules. Note that the service is only started on server startup.

Related Topic