My Oracle Support Banner

Auditctl Reading Rules File Returns "Field option not supported by kernel: exe" (Doc ID 2560185.1)

Last updated on JULY 04, 2019

Applies to:

Linux OS - Version Oracle Linux 7.2 with Unbreakable Enterprise Kernel [4.1.12] and later
Linux x86-64


Auditctl reading rules file returns "Field option not supported by kernel: exe". 

While audit.rules file the following error is returned.

Field option not supported by kernel: exe
There was an error in line 40 of /etc/audit/rules.d/audit.rules
The "exe" option at line 40 is not recognized by kernel
40 -a always,exit -F arch=b64 -S setresuid -F a0=0 -F exe=/usr/bin/sudo -F
key=10.2.5-elevated-privs-ses sion
41 -a always,exit -F arch=b64 -S setuid -F a0=0 -F exe=/usr/bin/su -F



To view full details, sign in with your My Oracle Support account.

Don't have a My Oracle Support account? Click to get started!

In this Document

My Oracle Support provides customers with access to over a million knowledge articles and a vibrant support community of peers and Oracle experts.