From: Steve Grubb <sgrubb@redhat.com>
To: Leigh Purdie <intersect@gmail.com>
Cc: linux-audit@redhat.com
Subject: Re: Dispatcher - single line output (perl)
Date: Thu, 25 May 2006 08:30:02 -0400 [thread overview]
Message-ID: <200605250830.03031.sgrubb@redhat.com> (raw)
In-Reply-To: <1ba978500605241722h6c58f05by30556fdcc01abdb8@mail.gmail.com>
On Wednesday 24 May 2006 20:22, Leigh Purdie wrote:
> So, to rephrase my question slightly - is there a programmatic way to
> turn syscall=5 into syscall=execve that anyone can suggest?
OK, then libaudit has that function, audit_syscall_to_name(). There are
several factors that have to be considered to correctly interpret a syscall
name.
> WRT perl, I'm language agnostic. If there's better support for audit
> in python, I'll switch the code over.
Yes, there is better support for python right now. We've also written a
dispatcher used for real-time SE Linux event analysis using python. It grabs
the events as a dictionary and passes them on for analysis. I should be
releasing audit-1.2.3 today which improves python support a little bit more.
-Steve
next prev parent reply other threads:[~2006-05-25 12:30 UTC|newest]
Thread overview: 12+ messages / expand[flat|nested] mbox.gz Atom feed top
2006-05-22 12:35 Dispatcher - single line output (perl) Leigh Purdie
2006-05-22 14:22 ` Steve Grubb
2006-05-23 0:45 ` Leigh Purdie
2006-05-23 14:22 ` Steve Grubb
2006-05-24 1:26 ` Leigh Purdie
2006-05-24 12:41 ` Steve Grubb
2006-05-25 0:22 ` Leigh Purdie
2006-05-25 12:30 ` Steve Grubb [this message]
2006-05-25 13:52 ` Steve Grubb
2006-08-08 1:32 ` Leigh Purdie
2006-05-24 15:14 ` Valdis.Kletnieks
2006-05-25 0:26 ` Leigh Purdie
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=200605250830.03031.sgrubb@redhat.com \
--to=sgrubb@redhat.com \
--cc=intersect@gmail.com \
--cc=linux-audit@redhat.com \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.