diff -urp audit-2.3.3.orig/init.d/auditd.service audit-2.3.3/init.d/auditd.service --- audit-2.3.3.orig/init.d/auditd.service 2014-01-16 06:24:42.000000000 -0500 +++ audit-2.3.3/init.d/auditd.service 2014-03-18 12:47:13.682617960 -0400 @@ -8,12 +8,11 @@ RefuseManualStop=yes [Service] ExecStart=/sbin/auditd -n -## To use augenrules, copy this file to /etc/systemd/system/auditd.service -## and uncomment the next line and delete/comment out the auditctl line. -## Then copy existing rules to /etc/audit/rules.d/ -## Not doing this last step can cause loss of existing rules -#ExecStartPost=-/sbin/augenrules --load -ExecStartPost=-/sbin/auditctl -R /etc/audit/audit.rules +## To not use augenrules, copy this file to /etc/systemd/system/auditd.service +## and comment/delete the next line and uncomment the auditctl line. +## NOTE: augenrules expect any rules to be added to /etc/audit/rules.d/ +ExecStartPost=-/sbin/augenrules --load +#ExecStartPost=-/sbin/auditctl -R /etc/audit/audit.rules ExecReload=/bin/kill -HUP $MAINPID [Install]