12.10. Disabling augenrules

Use the following steps to disable the augenrules utility. This switches Audit to use rules defined in the /etc/audit/audit.rules file.

Procédure

Copy the /usr/lib/systemd/system/auditd.service file to the /etc/systemd/system/ directory:
```
# cp -f /usr/lib/systemd/system/auditd.service /etc/systemd/system/
```
Edit the /etc/systemd/system/auditd.service file in a text editor of your choice, for example:
```
# vi /etc/systemd/system/auditd.service
```
Comment out the line containing augenrules, and uncomment the line containing the auditctl -R command:
```
#ExecStartPost=-/sbin/augenrules --load
ExecStartPost=-/sbin/auditctl -R /etc/audit/audit.rules
```
Reload the systemd daemon to fetch changes in the auditd.service file:
```
# systemctl daemon-reload
```
Restart the auditd service:
```
# service auditd restart
```

Ressources supplémentaires