Hi.
On Tue, Jun 27, 2023 at 10:54:32AM -0400, David Mehler wrote:
> used because the interface(s) are all getting there IP addresses
> statically assigned.
New plan then.
apt install auditd
echo '-a always,exit -F arch=b64 -S sethostname' \
> /etc/audit/rules.d/hostname.rules
echo '-a always,exit -F path=/proc/sys/kernel/hostname -F perm=wa' \
>> /etc/audit/rules.d/hostname.rules
service auditd restart
reboot
Whatever's trying to change the hostname should leave a trace in
/var/log/audit/audit.log.
PS Here it's customary to reply at the bottom of e-mail, not at the top.
There's no need to quote the mail you're replying to in full.
Reco
