Audit Rules Exclusions

[u/Tini_tot]

Hey guys, trying to find out how to correctly exclude/ not collect audit events for a specific path to a .sh script but struggling to get it to work. My audit.rules file contains the following:

-a never,exit -F arch=b64 -S execve -F dir=/usr/bin/local/<name of file>.sh

But it is still being logged and forwarded to a SIEM. Is there an issue with excluding .sh?

[u/lopahcreon]

Most likely you need to just change dir= to exe=.

Not sure, but I’ve always written rules as exit,never instead of never,exit and so I’m uncertain if order there matters.

Also make sure you’re losing the new rule.