I am trying to audit a directory tree for read, write, and permissions change. I created the rule using auditctl -w <path> -k media-watch, but ausearch -k media-watch only shows the creation (or deletion for debugging) of the rule, and not file creation or changes within the specified directory or below it in the tree. Selinux is disabled, if that's relevant.
Why? How can I make sure file access/changes are logged for auditing?
Last week I updated my kernel using the regular DNF update process. On reboot, none of the drives in my mdadm arrays were detected. I narrowed down the issue to a problem with the kernel and used an older kernel to boot. I waited a week for the next kernel update and ran the process again, hoping it was just a bad kernel, but the problem has not been resolved. Dmesg shows kernel: mpt2sas_cm0: failure at drivers/scsi/mpt3sas/mpt3sas_scsih.c:10790/_scsih_probe()! on both 5.8 kernels. After some research, I'm pretty sure that Fedora has dropped support for sas2116 controllers (https://access.redhat.com/discussions/3722151?page=2), so I either need to find drivers for this card or replace it with a 12gb/s card.
What do you suggest? Where can I find drivers for this card for Fedora 32 and how do I install them, or what would be a good 12gb/s card to replace it with (the card currently drives a 24 bay supermicro backplane with 12 drives installed)? The card I currently use is a LSI 9201-16e.
I run a server using 5 drives in a raidz2 through zfs-fuse, but sometimes encounter an issue where the pool becomes unavailable. The issue seems to co-inside with high levels of activity on the pool, and I suspect that this is causing zfs-fuse to crash and not be remountable without the -l arg. This may simply be due to the fact that zfs-fuse runs in user mode.
This brought up the question of using ZOL instead of zfs-fuse for performance or stability reasons.
My question is: which is better and why? Are they at the same levels of maturity and stability? Would there be any issues switching over, or can I simply follow the instructions here.
The last post I found about this was from 2008, and I would like a more recent answer.