Auditctl Reading Rules File Returns "Field option not supported by kernel: exe" (Doc ID 2560185.1)

Last updated on JULY 04, 2019

Applies to:

Symptoms

Auditctl reading rules file returns "Field option not supported by kernel: exe". 

While audit.rules file the following error is returned.

Field option not supported by kernel: exe
There was an error in line 40 of /etc/audit/rules.d/audit.rules

The "exe" option at line 40 is not recognized by kernel

40 -a always,exit -F arch=b64 -S setresuid -F a0=0 -F exe=/usr/bin/sudo -F
key=10.2.5-elevated-privs-ses sion
41 -a always,exit -F arch=b64 -S setuid -F a0=0 -F exe=/usr/bin/su -F
key=10.2.5-elevated-privs-session

Cause

My Oracle Support provides customers with access to over a million knowledge articles and a vibrant support community of peers and Oracle experts.