Arch Linux

sandric

Member

From: Ukraine, Dnipropetrovsk

Registered: 2011-03-22

Posts: 15

how to enable audit framework (having 3.18.2 kernel)?

Hi, I very want to use auditctl to logging out my filesystem events like inotify does, but with pid of modifier, but I can not somehow. I followed audit framework arch wiki article, installed it and enabled, also adding audit boot param to kernel, here's my /etc/default/grub line with it:

GRUB_CMDLINE_LINUX_DEFAULT="quiet audit=1"

, and here's my

sudo cat /proc/cmdline

output:

BOOT_IMAGE=/boot/vmlinuz-linux root=UUID=59c7ed3d-5c1a-464e-8da0-6bcf76bc19d2 rw quiet audit=1

But with this done, when I run

sudo auditctl -w /home

, or even

sudo auditctl -s

I getting

Error - audit support not in kernel
Cannot open netlink audit socket

Does anybody knows how to fix this?
thx.

karol

Archivist

Registered: 2009-05-06

Posts: 25,440

Re: how to enable audit framework (having 3.18.2 kernel)?

I think you need CONFIG_AUDIT=y in the kernel config.
https://projects.archlinux.org/svntogit … /linux#n76

Last edited by karol (2015-02-24 16:29:04)

sandric

Member

From: Ukraine, Dnipropetrovsk

Registered: 2011-03-22

Posts: 15

Re: how to enable audit framework (having 3.18.2 kernel)?

Sorry, I do not really familiar with kernel compilation, can I pass this CONFIG_AUDIT=y via boot params in grub config, or I should really recompile kernel? Via ABS? (this is a newbie section, right? ;-))

tomk

Forum Fellow

From: Ireland

Registered: 2004-07-21

Posts: 9,839

Re: how to enable audit framework (having 3.18.2 kernel)?

Yes, via ABS: https://wiki.archlinux.org/index.php/Ke … ild_System

sandric

Member

From: Ukraine, Dnipropetrovsk

Registered: 2011-03-22

Posts: 15

Re: how to enable audit framework (having 3.18.2 kernel)?

Ok, I recompiled kernel, just as you suggested, and it works now. But soooo slow(..