I am trying to add rules that audit umount/umount2. My entries are: <from audit.rules> -a always,exit -F arch=b32 -S umount -F auid>=500 -F auid!=4294967295 -k umount # This line with 64 generates and error in the rules. -a always,exit -F arch=b64 -S umount -F auid>=500 -F auid!=4294967295 -k umount # These next two appear to be ok -a always,exit -F arch=b32 -S umount2 -F auid>=500 -F auid!=4294967295 -k umount -a always,exit -F arch=b64 -S umount2 -F auid>=500 -F auid!=4294967295 -k umount < end audit.rules> Can some please tell me why this line is generating and error and possibly a solution? Thank you, Paul -- redhat-list mailing list unsubscribe mailto:redhat-list-request@xxxxxxxxxx?subject=unsubscribe https://www.redhat.com/mailman/listinfo/redhat-list
