Hello, my guess is /home or /home/ubuntu may not exist when the audit rules are loaded.
The file and directory watches work by setting up inotify watches on the underlying objects, and if the file or directory doesn't exist, there's nothing to watch. So, it errors.
You can add -i to the configuration file to have it continue onwards despite the error:
-i When given by itself, ignore errors when reading rules
from a file. This causes auditctl to always return a success exit code. If passed as an argument to -s then
it gives an interpretation of the numbers to human readable words if possible.
I'm not sure what to suggest for actually working around the problem, though. Reloading the rules some point after booting, once all the filesystems are mounted, would make sense, but I'm not sure how to ask systemd to do that.
Hello, my guess is /home or /home/ubuntu may not exist when the audit rules are loaded.
The file and directory watches work by setting up inotify watches on the underlying objects, and if the file or directory doesn't exist, there's nothing to watch. So, it errors.
You can add -i to the configuration file to have it continue onwards despite the error:
-i When given by itself, ignore errors when reading rules
success exit code. If passed as an argument to -s then
readable words if possible.
from a file. This causes auditctl to always return a
it gives an interpretation of the numbers to human
I'm not sure what to suggest for actually working around the problem, though. Reloading the rules some point after booting, once all the filesystems are mounted, would make sense, but I'm not sure how to ask systemd to do that.
Thanks