Enable kernel auditing in the example configuration

CSdread · Dec 1, 2016 · c1a40ab · c1a40ab
1 parent 29a3640
commit c1a40ab
Showing 1 changed file with 2 additions and 0 deletions.
diff --git a/go-audit.yaml.example b/go-audit.yaml.example
@@ -90,6 +90,8 @@ rules:
   - -a exit,always -F arch=b64 -S execve
   # Watch all 32 bit program executions
   - -a exit,always -F arch=b32 -S execve
+  # Enable kernel auditing (required if not done via the "audit" kernel boot parameter)
+  - -e 1
 
 # If kaudit filtering isn't powerful enough you can use the following filter mechanism
 filters: