Oracle Linux - auditd Rule Load Failure – Immutable Mode Enabled

Note!!Please register a free account to access the full content and also to participate in Q&A in the community”

APPLIES TO:
Oracle Cloud Infrastructure
Linux OS

SYMPTOMS

When attempting to load a new auditd rule, the following error appears:

#auditctl -w /tmp/test -p war -k monitor-test
The audit system is in immutable mode, no rule changes allowed

Checking existing rules shows no rules applied:

#auditctl -l
No rules

CAUSE
The audit system is in immutable mode.

This means audit rule changes are not allowed at runtime.

This is typically configured by setting the "-e 2" flag in one of the audit rule files under