/usr/share/audit/sample-rules/
/usr/share/audit/sample-rules
NameSizeModeActions
10-base-config.rules2440644editdlrm
10-no-audit.rules2840644editdlrm
11-loginuid.rules930644editdlrm
12-cont-fail.rules3330644editdlrm
12-ignore-error.rules3270644editdlrm
20-dont-audit.rules5160644editdlrm
21-no32bit.rules2730644editdlrm
22-ignore-chrony.rules2540644editdlrm
23-ignore-filesystems.rules5070644editdlrm
30-nispom.rules49430644editdlrm
30-ospp-v42-1-create-failed.rules15000644editdlrm
30-ospp-v42-1-create-success.rules7460644editdlrm
30-ospp-v42-2-modify-failed.rules16460644editdlrm
30-ospp-v42-2-modify-success.rules8260644editdlrm
30-ospp-v42-3-access-failed.rules6250644editdlrm
30-ospp-v42-3-access-success.rules3990644editdlrm
30-ospp-v42-4-delete-failed.rules5620644editdlrm
30-ospp-v42-4-delete-success.rules2840644editdlrm
30-ospp-v42-5-perm-change-failed.rules8160644editdlrm
30-ospp-v42-5-perm-change-success.rules4140644editdlrm
30-ospp-v42-6-owner-change-failed.rules5790644editdlrm
30-ospp-v42-6-owner-change-success.rules2950644editdlrm
30-ospp-v42.rules59480644editdlrm
30-pci-dss-v31.rules64970644editdlrm
30-stig.rules69420644editdlrm
31-privileged.rules14580644editdlrm
32-power-abuse.rules2130644editdlrm
40-local.rules1560644editdlrm
41-containers.rules4390644editdlrm
42-injection.rules6720644editdlrm
43-module-load.rules3980644editdlrm
44-installers.rules5840644editdlrm
70-einval.rules3260644editdlrm
71-networking.rules1510644editdlrm
99-finalize.rules860644editdlrm
README-rules14210644editdlrm
Edit: /usr/share/audit/sample-rules/30-ospp-v42-3-access-success.rules (399B)
## Successful file access (any other opens) This has to go last. ## These next two are likely to result in a whole lot of events -a always,exit -F arch=b32 -S open,openat,openat2,open_by_handle_at -F success=1 -F auid>=1000 -F auid!=unset -F key=successful-access -a always,exit -F arch=b64 -S open,openat,openat2,open_by_handle_at -F success=1 -F auid>=1000 -F auid!=unset -F key=successful-access