Comment 3 for bug 140784

To the best of my knowledge, the auditd package only seems to work when
using AppArmor. However, using regular auditd configurations like those
mentioned in previous posts do not work. That is unfortunate since AppArmor
doesn't meet my auditing requirements and it appears (from what I've read
about it) that auditd should.

Chris Bozic

On Nov 30, 2007 6:12 AM, Andrew Whyte <email address hidden> wrote:

> Same here:
> $ sudo service auditd status
> => * auditd is running.
> $ sudo auditctl -w /etc/passwd
> => Error sending add rule data request (Invalid argument)
> Has anyone found a solution? Apparently auditing has moved into the
> kernel, but I can't see any evidence of this in Gutsy. As it is, the
> "auditd" package is pretty useless...
> --
> auditctl: Error sending add rule data request (Invalid argument)
> You received this bug notification because you are a direct subscriber
> of the bug.