[Date Prev][Date Next]   [Thread Prev][Thread Next]   [Thread Index] [Date Index] [Author Index]

Re: type=SYSCALL, key= field?



On Monday 31 July 2006 14:09, Michael C Thompson wrote:
> I'm not sure what this is meant to be related to, any clues?

auditctl -a always,exit -S open -F key=something

It's so that you can label the event with any information an admin wants.

-Steve


[Date Prev][Date Next]   [Thread Prev][Thread Next]   [Thread Index] [Date Index] [Author Index]