Comment 1 for bug 2020838

Revision history for this message
Seth Arnold (seth-arnold) wrote :

Hello, my guess is /home or /home/ubuntu may not exist when the audit rules are loaded.

The file and directory watches work by setting up inotify watches on the underlying objects, and if the file or directory doesn't exist, there's nothing to watch. So, it errors.

You can add -i to the configuration file to have it continue onwards despite the error:

       -i When given by itself, ignore errors when reading rules
              from a file. This causes auditctl to always return a
              success exit code. If passed as an argument to -s then
              it gives an interpretation of the numbers to human
              readable words if possible.

I'm not sure what to suggest for actually working around the problem, though. Reloading the rules some point after booting, once all the filesystems are mounted, would make sense, but I'm not sure how to ask systemd to do that.

Thanks