So if I add a rule with auditctl it gives a meaningful error. auditctl -a exit,always -F arch=b32 -S stime -k stime32 Error sending add rule data request (Rule exists) If you add a duplicate line in the audit.rules files and restart auditd it just says error on line. This is not very helpful. The system is able to detect duplicate lines but does not provide a meaning full error. Dave W