Why does the file /etc/audit/audit.rules becomes /etc/audit/audit.rules.prev if changed in %post script of kickstart in Red Hat Enterprise Linux 7?

Solution Unverified - Updated 2025-08-12T03:55:03+00:00 -

Issue

Why does the file /etc/audit/audit.rules becomes /etc/audit/audit.rules.prev if changed in %post script of kickstart after RHEL7?

A Red Hat subscription provides unlimited access to our knowledgebase, tools, and much more.

Here are the common uses of Markdown.

Code blocks

~~~
Code surrounded in tildes is easier to read
~~~

Links/URLs

[Red Hat Customer Portal](https://access.redhat.com)