The audit-audispd-plugins package contains plugin components for the
audit dispatcher (audispd).
Provides
Requires
License
GPL-2.0-or-later
Changelog
* Mon Jan 26 2026 Callum Farmer <gmbr3@opensuse.org>
- Move all /var/spool, /var/log directories to systemd-tmpfiles
* Tue Jun 10 2025 Wolfgang Frisch <wolfgang.frisch@suse.com>
- Refresh systemd service patches:
- audit-allow-manual-stop.patch
- auditd.service-fix-plugin-termination.patch
- enable-stop-rules.patch
- fix-hardened-service.patch
- harden_auditd.service.patch
- Update to 4.0.2
- Fix musl C builds
- Many code cleanups (Yugend)
- Use atomic variables if available for signal related flags
- Dont rotate audit logs when auditd is in debug mode
- Fix a couple memory leaks on error paths
- Correct output when displaying rules with exe/path/dir (Attila Lakatos)
- Fix auparse lookup test to not use the system libaupaurse
- Improve auparse metrics
- Update auparse normalizer for recent syscalls
- Make status report uniform
- Update to 4.0.1
- Update TRUSTED_APP interpretation to look for known fields
- In auditd plugins, allow variable amount of arguments (Attila Lakatos)
- Fix augenrules to work correctly when kernel is in immutable mode
- Add ausearch_cur_event to auparse library (Attila Lakatos)
- Add audisp-filter plugin (Attila Lakatos)
- Improve sorting speed of aureport --summary reports
- auditd & audit-rules.service pick up paths automatically (Laurent Bigonville)
- Update auparse normalizer for new syscalls
* Fri Oct 04 2024 Enzo Matsumiya <ematsumiya@suse.com>
- Update audit.spec (bsc#1231236):
* add requirement for 'awk' package
* move some %post logic from audit to audit-rules
* Wed Oct 02 2024 Enzo Matsumiya <ematsumiya@suse.com>
- Readd audit-allow-manual-stop.patch (removed by mistake)
* Tue Oct 01 2024 Enzo Matsumiya <ematsumiya@suse.com>
- Fix plugin termination when using systemd service units (bsc#1215377)
* add auditd.service-fix-plugin-termination.patch
* Thu Sep 26 2024 Enzo Matsumiya <ematsumiya@suse.com>
- Update audit-secondary.spec:
* Add "Requires: audit-rules" for audit package
* Remove preun/postun handling of audit-rules.service
* Tue Sep 17 2024 Enzo Matsumiya <ematsumiya@suse.com>
- Update to 4.0
- Drop python2 support
- Drop auvirt and autrace programs
- Drop SysVinit support
- Require the use of the 5.0 or later kernel headers
- New README.md file
- Rewrite legacy service functions in terms of systemctl
- Consolidate and update end of event detection to a common function
- Split off rule loading from auditd.service into audit-rules.service
- Refactor libaudit.h to split out logging functions and record numbers
- Speed up aureport --summary reports
- Limit libaudit python bindings to logging functions
- Add a metrics function for auparse
- Change auditctl to use pidfd_send_signal for signaling auditd
- Adjust watches to optimize syscalls hooked when watch file access
- Drop nispom rules
- Add intepretations for fsconfig, fsopen, fsmount, & move_mount
- Many code fixups (cgzones)
- Update syscall and interpretation tables to the 6.8 kernel
(from v3.1.2)
- When processing a run level change, make auditd exit
- In auditd, fix return code when rul