questions about auditing on a new RH 6 box

[Steve Grubb]

On Friday, January 14, 2011 12:35:06 pm LC Bruzenak wrote:
> Probably can use a sampling of events as well.

Since keys are not being used to classify events (hint hint) the best you can do is 
run something like this:

aureport --start today --summary --syscall -i

-Steve