{
    "mode": "man",
    "parameter": "AUGENRULES",
    "section": "8",
    "url": "https://www.chedong.com/phpMan.php/man/AUGENRULES/8/json",
    "generated": "2026-09-16T14:39:57Z",
    "synopsis": "augenrules [--check] [--load]",
    "sections": {
        "NAME": {
            "content": "augenrules - a script that merges component audit rule files\n",
            "subsections": []
        },
        "SYNOPSIS": {
            "content": "augenrules [--check] [--load]\n",
            "subsections": []
        },
        "DESCRIPTION": {
            "content": "augenrules  is a script that merges all component audit rules files, found in the audit rules\ndirectory, /etc/audit/rules.d, placing the merged file in  /etc/audit/audit.rules.  Component\naudit  rule  files,  must end in .rules in order to be processed. All other files in /etc/au‐\ndit/rules.d are ignored.\n\nThe files are concatenated in order, based on their natural sort (see -v option of ls(1)) and\nstripped of empty and comment (#) lines.\n\nThe last processed -D directive without an option, if present, is always emitted as the first\nline in the resultant file. Those with an option are replicated in place.  The last processed\n-b directive, if present, is always emitted as the second line in the  resultant  file.   The\nlast processed -f directive, if present, is always emitted as the third line in the resultant\nfile.  The last processed -e directive, if present, is always emitted as the last line in the\nresultant file.\n\nThe generated file is only copied to /etc/audit/audit.rules, if it differs.\n",
            "subsections": []
        },
        "OPTIONS": {
            "content": "",
            "subsections": [
                {
                    "name": "--check",
                    "content": "test if rules have changed and need updating without overwriting audit.rules.\n\n--load load old or newly built rules into the kernel.\n\n",
                    "long": "--check"
                }
            ]
        },
        "FILES": {
            "content": "/etc/audit/rules.d/ /etc/audit/audit.rules\n",
            "subsections": []
        },
        "SEE ALSO": {
            "content": "audit.rules(7), auditctl(8), auditd(8).\n\nRed Hat                                       Apr 2013                                 AUGENRULES(8)",
            "subsections": []
        }
    },
    "summary": "augenrules - a script that merges component audit rule files",
    "flags": [
        {
            "flag": "",
            "long": "--check",
            "arg": null,
            "description": "test if rules have changed and need updating without overwriting audit.rules. --load load old or newly built rules into the kernel."
        }
    ],
    "examples": [],
    "see_also": [
        {
            "name": "audit.rules",
            "section": "7",
            "url": "https://www.chedong.com/phpMan.php/man/audit.rules/7/json"
        },
        {
            "name": "auditctl",
            "section": "8",
            "url": "https://www.chedong.com/phpMan.php/man/auditctl/8/json"
        },
        {
            "name": "auditd",
            "section": "8",
            "url": "https://www.chedong.com/phpMan.php/man/auditd/8/json"
        }
    ]
}