---
name: "augenrules"
section: "8"
platform: "linux"
package: "audit"
version: "4.2.1-1"
release: "Arch Linux 2026-11-01"
platforms: ["linux"]
url: "https://new.carta.tech/augenrules"
---

# augenrules(8)

a script that merges component audit rule files

## NAME

augenrules - a script that merges component audit rule files

## SYNOPSIS

**augenrules** \[*--check*\] \[*--load*\]

## DESCRIPTION

**augenrules** is a script that merges all component audit rules files, found in the audit rules directory, */etc/audit/rules.d*, placing the merged file in */etc/audit/audit.rules*. Component audit rule files, must end in *.rules* in order to be processed. All other files in */etc/audit/rules.d* are ignored.

The files are concatenated in order, based on their natural sort (see -v option of [ls(1)](/ls/1.md)) and stripped of empty and comment (#) lines.

The last processed -*D* directive without an option, if present, is always emitted as the first line in the resultant file. Those with an option are replicated in place. The last processed -*b* directive, if present, is always emitted as the second line in the resultant file. The last processed -*f* directive, if present, is always emitted as the third line in the resultant file. The last processed -*e* directive, if present, is always emitted as the last line in the resultant file.

The generated file is only copied to */etc/audit/audit.rules*, if it differs.

## OPTIONS

- **--check**

  test if rules have changed and need updating without overwriting audit.rules.

- **--load**

  load old or newly built rules into the kernel.

## FILES

/etc/audit/rules.d/ /etc/audit/audit.rules

## SEE ALSO

[**audit.rules**(7)](/audit.rules/7.md), [**auditctl**(8)](/auditctl/8.md), [**auditd**(8)](/auditd/8.md).