From: Steve Grubb <sgrubb@redhat.com>
To: linux-audit@redhat.com
Subject: Re: type=PROCTITLE events not being populated in /var/log/audit/audit.log
Date: Wed, 10 Jan 2018 18:22:10 -0500 [thread overview]
Message-ID: <12529563.ICzKhQbRlM@x2> (raw)
In-Reply-To: <DM3P100MB0140055AB09C7860B6C96F07F2110@DM3P100MB0140.NAMP100.PROD.OUTLOOK.COM>
Hello,
On Wednesday, January 10, 2018 5:41:03 PM EST Joshua Ammons wrote:
> I wanted to check if anyone was aware of a setting on RedHat box for
> enabling the PROCTITLE event type for audit logs?
Nope.
> Is there any difference between RedHat and CentOS?
I have seen studies that show there are differences.
> I have one box running RedHat 7.3 and another running CentOS 7.3, with
> auditd enabled on both with the same rules. However, only the RedHat box is
> populating the event type PROCTITLE - the CentOS box does not.
You might move that box to Centos 7.4. The proctitle records was a kernel
enhancement shipped in RHEL 7.4.
-Steve
> I would like to get the PROCTITLE event type working on my CentOS box as
> well, if possible, but I cannot find any documentation online about anyone
> else having this issue and how to resolve.
>
> Thanks for your time.
>
> Joshua Ammons Advanced SIEM Engineer, Cybersecurity
> Global Business Services
prev parent reply other threads:[~2018-01-10 23:22 UTC|newest]
Thread overview: 2+ messages / expand[flat|nested] mbox.gz Atom feed top
2018-01-10 22:41 type=PROCTITLE events not being populated in /var/log/audit/audit.log Joshua Ammons
2018-01-10 23:22 ` Steve Grubb [this message]
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=12529563.ICzKhQbRlM@x2 \
--to=sgrubb@redhat.com \
--cc=linux-audit@redhat.com \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.