LIBAUDIT.CONF(5)

📦 version 4.2.1, in alpine 3.22, alpine 3.23, alpine 3.24, arch rolling, centos-stream 10, centos-stream 9, debian bookworm, debian trixie, fedora 43, fedora 44, nixpkgs unstable, opensuse-leap 16.0, ubuntu jammy, ubuntu noble, ubuntu questing, ubuntu resolute, ubuntu stonking

💖 NAME 💖

okay so the manual name is libaudit.conf, and it's the libaudit configuration file 🎀✨

🌸 DESCRIPTION 🌸

okay bestie, listen 👂 the file /etc/libaudit.conf holds the config info for userspace apps that link to libaudit 💅 these apps are the ones that have to read the settings in this file and actually follow what the admin wants 🫶 no skipping!!

the file has one keyword per line 📝 then an equal sign 🟰 then the config info that goes with it. the only keyword it recognizes is failure_action, and that's what we're about to get into 😭

🚨 failure_action 🚨

this one is the big deal 💀 it tells a userspace app what the admin wants it to do when it fails to send an audit event to the kernel. there are three possible values:
  • IGNORE — do nothing at all 🙈 just vibe through it
  • LOG — write to syslog that the audit event couldn't be sent 📜
  • TERMINATE — the userspace app should exit 🛑 bye bye bestie

🦋 SEE ALSO 🦋

okay so if you want more deets, check out get_auditfail_action(3) 📖💜

👑 AUTHOR 👑

written by Steve Grubb 🫶🔥

ok that's the whole tea ☕ this page is from Red Hat, dated Oct 2009, under the LIBAUDIT.CONF(5) manual 🌈✨ stay iconic and keep your configs tidy, bestie 💅🎀

📦 where this page comes from