CentOS Stream 10 – Common Problem 196 – Diagnosis and Fix

📖 ~1 min read

Table of contents

1. Symptom & Impact
2. Environment & Reproduction
3. Root Cause Analysis
4. Quick Triage
5. Step-by-Step Diagnosis
6. Solution – Primary Fix
7. Solution – Alternative Approaches
8. Verification & Acceptance Criteria
9. Rollback Plan
10. Prevention & Hardening
11. Related Errors & Cross-Refs
12. References & Further Reading

Symptom & Impact

augenrules –load fails with ‘rule exists’ or invalid syscall messages.

Environment & Reproduction

Old rule files from a previous kernel version reference renamed syscalls.

uname -r
auditctl -s

Root Cause Analysis

auditd refuses unknown or duplicate rules and stops loading the rest.

Quick Triage

Validate rule files individually.

for f in /etc/audit/rules.d/*.rules; do echo $f; auditctl -R $f; done

Step-by-Step Diagnosis

Identify offending lines and disabled syscalls.

augenrules --check
auditctl -l

Solution – Primary Fix

Remove deprecated lines and reload.

sed -i '/-S removed_syscall/d' /etc/audit/rules.d/*.rules
augenrules --load

Solution – Alternative Approaches

Move legacy rules to an archive directory.

mkdir -p /etc/audit/rules.d.archive && mv /etc/audit/rules.d/legacy-*.rules /etc/audit/rules.d.archive/

Verification & Acceptance Criteria

auditctl -s reports ‘enabled 1’ and rules are loaded.

auditctl -l | wc -l

Rollback Plan

Restore the archived rules.

mv /etc/audit/rules.d.archive/* /etc/audit/rules.d/ && augenrules --load

Prevention & Hardening

Run augenrules –check on every kernel bump.

augenrules --check

Related Errors & Cross-Refs

Invalid syscall, rule exists, audit rule load failure.

Related tutorial: View the step-by-step tutorial for centos-stream-10.

View all centos-stream-10 tutorials on the Tutorials Hub →

Browse all common problems & solutions on the Tutorials Hub.

References & Further Reading

auditd docs, audit.rules man page.