---
name: config-fix-verified-against-the-winning-merge-not-your-file
description: "A config remediation is only real when the MERGED/effective state shows it — a package-default file that sorts LAST in a rules.d merge silently overrode my 50-*.rules; verify with the runtime readback (auditctl -s), and re-verify after the next service restart."
metadata: 
  node_type: memory
  type: project
  originSessionId: 0e501f1f-bba6-49e0-81cd-db288f425892
  modified: 2026-08-25T21:56:55.069Z
---

Kitsubito audit remediation, 2026-08-25. I wrote `/etc/audit/rules.d/50-backlog.rules`
(`-b 32768`, `--backlog_wait_time 0`) — but `apt install auditd` ships
`/etc/audit/rules.d/audit.rules` carrying `-b 8192` / `--backlog_wait_time 60000`, and in the
augenrules lexical merge digits sort BEFORE letters, so `audit.rules` merges LAST and its
values WIN (last-directive-wins). Kernel state silently stayed 8192/60000 through a whole proof
run; my file greps fine, `augenrules --check` says "No change", everything LOOKS applied.
The proof run's 62.7s red was nearly re-blamed on the "failed" remediation — measuring the
window (backlog 0, lost flat, no new backlog-limit lines) showed no pressure occurred at all.

**Why:** file-level layering (rules.d, conf.d, sysctl.d) resolves by sort order + last-wins;
writing a correctly-spelled fragment proves nothing about the merged result. And the
ExecStartPost `augenrules --load` at service start re-applies the MERGE, so a runtime `auditctl`
fix silently reverts on the next restart.

**How to apply:**
- Verify a remediation at the EFFECTIVE layer: the kernel/runtime readback (`auditctl -s`,
  `sysctl <key>`, the daemon's own status verb) — never the fragment you wrote.
- Check what the merge produced (`/etc/audit/audit.rules`, the rendered config) and WHICH file
  sorts last; numeric prefixes lose to alphabetic names in rules.d.
- Prefer editing the winning file (or a fragment that provably sorts after it) over adding a
  numbered fragment; then restart-cycle the service once and read back again.
- Same measurement family as [[dont-take-a-diagnosis-as-measured]]: "remediation done" in a
  commune is a state CLAIM — the readback is the measurement.