All
Just a heads up, as this is not mentioned in the README for 22.04, the version of auditd has changed from v2.8.5 to v3.0.7.
The significant difference that has impacted my installation, using Puppet for configuration, has been the moving of the Audit Dispatcher into Audit.
As mentioned in this article https://access.redhat.com/solutions/3806561 (paywall - but gives away enough information in the teaser) there is no /etc/audisp directory in v3.
Now trying to find documentation to see what configuration I need to change to get things to work again.
Cheers
Jim
Bookmarks