I've observed, that adding audit rules on vserver kernels does not work.
Since this failure is not logged at any prominent position, I haven't
noticed it till now and I'm not sure when this problem might have first
occurred (A quick check showed, that it is present since at least
3.13.5-vs126.96.36.199 on amd64).
Since this is working on Ubuntu stock kernels, I also do not know, if the
problem was introduced by using problematic kernel configuration on my side
of if it might be really vserver specific.
Could someone with an own build of vserver kernel please test if auditctl
works on his system?
# apt-get install auditd
# auditctl -l
# auditctl -a exit,always -F arch=b32 -S unlink -S rmdir
Error sending add rule request (Operation not supported)