title: CentOS7 audit rules rate_limit changes were returned to defaults with restart
body: <p>When I restart <code>CentOS Linux release 7.9.2009 (Core)</code>, the audit service rate_limit changes to default 5000 and I could not find where it is set.</p>
  <p>I have changed the rules file like below, and when I run manually
  <code>augenrules --load</code> reads the rules and changes the rate_limit, but when I restart the server the rate limit returns to 5000.</p>
  <pre><code>cat /etc/audit/rules.d/audit.rules
  ## First rule - delete all
  -D
  
  ## Increase the buffers to survive stress events.
  ## Make this bigger for busy systems
  -b 8192
  
  ## Set failure mode to syslog
  -f 1
  ## sets the rate of generated messages per second
  -r 0
  </code></pre>
  <p>I have checked the service file and actually, it does run the same command <code>/sbin/augenrules --load</code></p>
  <pre><code>cat  /usr/lib/systemd/system/auditd.service
  [Unit]
  Description=Security Auditing Service
  DefaultDependencies=no
  ## If auditd is sending or recieving remote logging, copy this file to
  ## /etc/systemd/system/auditd.service and comment out the first After and
  ## uncomment the second so that network-online.target is part of After.
  ## then comment the first Before and uncomment the second Before to remove
  ## sysinit.target from &quot;Before&quot;.
  After=local-fs.target systemd-tmpfiles-setup.service
  ##After=network-online.target local-fs.target systemd-tmpfiles-setup.service
  Before=sysinit.target shutdown.target
  ##Before=shutdown.target
  Conflicts=shutdown.target
  RefuseManualStop=yes
  ConditionKernelCommandLine=!audit=0
  Documentation=man:auditd(8) https://github.com/linux-audit/audit-documentation
  
  [Service]
  Type=forking
  PIDFile=/run/auditd.pid
  ExecStart=/sbin/auditd
  ## To not use augenrules, copy this file to /etc/systemd/system/auditd.service
  ## and comment/delete the next line and uncomment the auditctl line.
  ## NOTE: augenrules expect any rules to be added to /etc/audit/rules.d/
  ExecStartPost=-/sbin/augenrules --load
  #ExecStartPost=-/sbin/auditctl -R /etc/audit/audit.rules
  # By default we don't clear the rules on exit. To enable this, uncomment
  # the next line after copying the file to /etc/systemd/system/auditd.service
  #ExecStopPost=/sbin/auditctl -R /etc/audit/audit-stop.rules
  
  [Install]
  WantedBy=multi-user.target
  </code></pre>
  <p>Any idea would be helpful</p>