PATH:
usr
/
share
/
audit
/
sample-rules
## First rule - delete all -D ## Increase the buffers to survive stress events. ## Make this bigger for busy systems -b 8192 ## This determine how long to wait in burst of events --backlog_wait_time 60000 ## Set failure mode to syslog -f 1
[-] 30-ospp-v42-3-access-failed.rules
[edit]
[-] 22-ignore-chrony.rules
[edit]
[-] 30-ospp-v42-6-owner-change-failed.rules
[edit]
[-] 30-ospp-v42-2-modify-failed.rules
[edit]
[-] 43-module-load.rules
[edit]
[-] 30-ospp-v42-5-perm-change-failed.rules
[edit]
[-] 30-ospp-v42-1-create-failed.rules
[edit]
[-] 32-power-abuse.rules
[edit]
[-] 12-cont-fail.rules
[edit]
[-] 30-pci-dss-v31.rules
[edit]
[-] 41-containers.rules
[edit]
[-] 70-einval.rules
[edit]
[-] 20-dont-audit.rules
[edit]
[-] 30-stig.rules
[edit]
[-] 30-ospp-v42-3-access-success.rules
[edit]
[-] 44-installers.rules
[edit]
[-] 23-ignore-filesystems.rules
[edit]
[-] 30-ospp-v42-1-create-success.rules
[edit]
[-] 71-networking.rules
[edit]
[-] 12-ignore-error.rules
[edit]
[-] 99-finalize.rules
[edit]
[-] 30-ospp-v42-5-perm-change-success.rules
[edit]
[-] 30-ospp-v42-6-owner-change-success.rules
[edit]
[-] 30-ospp-v42-4-delete-success.rules
[edit]
[+]
..
[-] 30-ospp-v42-4-delete-failed.rules
[edit]
[-] 40-local.rules
[edit]
[-] README-rules
[edit]
[-] 30-ospp-v42.rules
[edit]
[-] 30-ospp-v42-2-modify-success.rules
[edit]
[-] 30-nispom.rules
[edit]
[-] 10-no-audit.rules
[edit]
[-] 31-privileged.rules
[edit]
[-] 42-injection.rules
[edit]
[-] 10-base-config.rules
[edit]
[-] 21-no32bit.rules
[edit]
[-] 11-loginuid.rules
[edit]