AUGENRULES(8)

📦 version 4.2.1, in alpine 3.22, alpine 3.23, alpine 3.24, arch rolling, centos-stream 10, centos-stream 9, debian bookworm, debian trixie, fedora 43, fedora 44, nixpkgs unstable, opensuse-leap 16.0, ubuntu jammy, ubuntu noble, ubuntu questing, ubuntu resolute, ubuntu stonking

✨ AUGENRULES — a script that merges component audit rule files ✨

okay bestie, gather round, because augenrules is literally the little admin script that does the ✨merging✨ for you. This is section 8 of the manual (system administration utilities, iykyk), and she is lowkey a lifesaver. 💖

🌸 SYNOPSIS 🌸

augenrules [--check] [--load]

🦋 DESCRIPTION 🦋

So here's the vibe. augenrules is a script that merges all the component audit rules files it can find in the audit rules directory, which is /etc/audit/rules.d, and then drops the merged result into /etc/audit/audit.rules. 💅

But listen, there's a dress code: component audit rule files must end in .rules to even get processed. Every other file chillin' in /etc/audit/rules.d gets ignored. Sorry not sorry. 🙈

The files get concatenated in order based on their natural sort (peep the -v option of ls(1) if you wanna know what that means), and then they get stripped of empty lines and comment lines (the ones starting with #). Clean. Fresh. Iconic. 🧚

Now for the main-character directives, because these ones get special treatment: 👑

  • The last processed -D directive without an option, if it's there, is always emitted as the first line in the resultant file. Those -D directives with an option get replicated in place instead.
  • The last processed -b directive, if present, is always emitted as the second line in the resultant file.
  • The last processed -f directive, if present, is always emitted as the third line in the resultant file.
  • The last processed -e directive, if present, is always emitted as the last line in the resultant file.

And the plot twist: the generated file is only actually copied to /etc/audit/audit.rules if it differs. No unnecessary writes, no drama. That's the boundary setting we love to see. 🫶

💅 OPTIONS 💅

  • --check — test if the rules have changed and need updating, without overwriting audit.rules. It's giving "just checking, no commitment". 👀
  • --load — load the old rules or the newly built rules into the kernel. Loaded. Shipped. Deployed. ✨

🎀 FILES 🎀

  • /etc/audit/rules.d/
  • /etc/audit/audit.rules

🔥 SEE ALSO 🔥

⭐ heads up bestie: the .rules suffix is not optional, the comment/empty-line stripping is real, and that "only copy if it differs" thing is the whole reason this script is polite. respect the rules directory. 🌈

that's the whole page, periodt 💜 brought to you by Red Hat, dated Apr 2013, and filed under AUGENRULES(8). slay, go merge ur rules. 🎀✨

📦 where this page comes from