# This file contains the auditctl rules that are loaded
# whenever the audit daemon is started via the initscripts.
# The rules are simply the parameters that would be passed
# to auditctl.

# First rule - delete all
-D
12:42pm {45} localhost:/root># less /etc/audit/audit.rules
# Increase the buffers to survive stress events.
# Make this bigger for busy systems
-b 320

# Feel free to add below this line. See auditctl man page

-a exit,always -S chroot
-a exit,always -S chdir -F obj_type=dhclient_t
-a exit,always -S chdir -F obj_type=sendmail_t
-a exit,always -S chdir -F obj_type=mcstransd_t
-a exit,always -S chdir -F obj_type=sshd_t
-a exit,always -S chdir -F obj_type=ntpd_t
-a exit,always -S chdir -F obj_type=samba_t
-a exit,always -S chdir -F obj_type=named_t
-a exit,always -S chdir -F obj_type=klogd_t
-a exit,always -S chdir -F obj_type=crond_t
-a exit,always -S chdir -F obj_type=httpd_t
-a exit,always -S chdir -F obj_type=auditd_t
-a exit,always -S chdir -F obj_type=portmap_t
-a exit,always -S chdir -F obj_type=syslogd_t