[Date Prev][Date Next]   [Thread Prev][Thread Next]   [Thread Index] [Date Index] [Author Index]

Re: audit test results on lspp.12 kernel



Linda Knippers wrote:
Hi Steve,
...  Loulwa mentioned a case where the string is missing.
I don't know if its really missing or just not found exactly
as expected.  Do you know if any messages were omitted as
part of the conversion?

From what I am seeing, I was talking about the msg= field which I am seeing is missing values ...

here is an example of what we used to see before, and what I am seeing now with the lspp.12 kernel ... Notice that in the first record there is a <msg=groudel> field, while in the second record, it is <msg='op=deleting group>.

type=USER_CHAUTHTOK msg=audit(1142347489.501:5273): user pid=12084 uid=0 auid=0 msg='groupdel: op=deleting group acct=laf_z exe="/usr/sbin/groupdel" (hostname=?, addr=?, terminal=pts/1 res=success)'

type=USER_CHAUTHTOK msg=audit(1142347489.501:5273): user pid=12084 uid=0 auid=0 msg='op=deleting group acct=laf_z exe="/usr/sbin/groupdel" (hostname=?, addr=?, terminal=pts/1 res=success)'

- Loulwa


[Date Prev][Date Next]   [Thread Prev][Thread Next]   [Thread Index] [Date Index] [Author Index]