如何在arch linux 3.12内核中启用审计框架？

Question

I want to use audit framework on my latest arch linux, but running sudo auditctl -w /home/ in console gives me

Error - audit support not in kernel Cannot open netlink audit socket

I tried to enable of course audit via kernel boot params setting audit flag: GRUB_CMDLINE_LINUX_DEFAULT="quiet audit=1" but nothing changes after reboot, still the same error.

Anybody knows how to fix it?

Answer 1

Recompile a kernel using ABS to get audit support. You will need to add CONFIG_AUDIT=y in the config file before makepkg -s .

PS Compilation might take very long.