From owner-freebsd-questions@FreeBSD.ORG  Fri Dec  7 21:06:08 2007
Return-Path: <owner-freebsd-questions@FreeBSD.ORG>
Delivered-To: freebsd-questions@freebsd.org
Received: from mx1.freebsd.org (mx1.freebsd.org [IPv6:2001:4f8:fff6::34])
	by hub.freebsd.org (Postfix) with ESMTP id A737316A420
	for <freebsd-questions@freebsd.org>;
	Fri,  7 Dec 2007 21:06:08 +0000 (UTC)
	(envelope-from pauls@utdallas.edu)
Received: from smtp3.utdallas.edu (smtp3.utdallas.edu [129.110.10.49])
	by mx1.freebsd.org (Postfix) with ESMTP id 8AE6F13C45A
	for <freebsd-questions@freebsd.org>;
	Fri,  7 Dec 2007 21:06:08 +0000 (UTC)
	(envelope-from pauls@utdallas.edu)
Received: from utd59514.utdallas.edu (utd59514.utdallas.edu [129.110.3.28])
	(using TLSv1 with cipher DHE-RSA-AES256-SHA (256/256 bits))
	(No client certificate requested)
	by smtp3.utdallas.edu (Postfix) with ESMTP id 328F565505
	for <freebsd-questions@freebsd.org>;
	Fri,  7 Dec 2007 15:06:08 -0600 (CST)
Date: Fri, 07 Dec 2007 15:06:07 -0600
From: Paul Schmehl <pauls@utdallas.edu>
To: FreeBSD Questions <freebsd-questions@freebsd.org>
Message-ID: <1DD9ABE123D4CF6F937ADD62@utd59514.utdallas.edu>
X-Mailer: Mulberry/4.0.8 (Linux/x86)
MIME-Version: 1.0
Content-Type: text/plain; charset=us-ascii; format=flowed
Content-Transfer-Encoding: 7bit
Content-Disposition: inline
Subject: Problems with auditd
X-BeenThere: freebsd-questions@freebsd.org
X-Mailman-Version: 2.1.5
Precedence: list
List-Id: User questions <freebsd-questions.freebsd.org>
List-Unsubscribe: <http://lists.freebsd.org/mailman/listinfo/freebsd-questions>, 
	<mailto:freebsd-questions-request@freebsd.org?subject=unsubscribe>
List-Archive: <http://lists.freebsd.org/pipermail/freebsd-questions>
List-Post: <mailto:freebsd-questions@freebsd.org>
List-Help: <mailto:freebsd-questions-request@freebsd.org?subject=help>
List-Subscribe: <http://lists.freebsd.org/mailman/listinfo/freebsd-questions>, 
	<mailto:freebsd-questions-request@freebsd.org?subject=subscribe>
X-List-Received-Date: Fri, 07 Dec 2007 21:06:08 -0000

I upgraded my system from 6.0 RELEASE to 6.2 RELEASE by cvsupping the files 
and then running buildkernel/buildworld as usual.  Since doing that, auditd 
will not run, even though I have auditd_enable="YES" in /etc/rc.conf. I've 
been reading online posts about auditd and auditing (as well as the man 
pages) but I haven't found what the problem is.

If I run audit -s, I get this:
root@utd59514# audit -s
Error sending trigger: Function not implemented

Any idea what the problem might be?  I *thought* I had the latest sources. 
I have since cvsupped a second time and rebuilt world, but I have not 
rebuilt the kernel.

-- 
Paul Schmehl (pauls@utdallas.edu)
Senior Information Security Analyst
The University of Texas at Dallas
http://www.utdallas.edu/ir/security/