From: Steve Grubb <sgrubb@redhat.com>
To: Peng Haitao <penght@cn.fujitsu.com>
Cc: audit-list <linux-audit@redhat.com>
Subject: Re: [PATCH 1/2] fix a bug that use option '-r' cannot output all unformatted logs
Date: Fri, 15 Aug 2008 14:04:32 -0400 [thread overview]
Message-ID: <200808151404.33089.sgrubb@redhat.com> (raw)
In-Reply-To: <488FBEA5.4080900@cn.fujitsu.com>
On Tuesday 29 July 2008 21:06:45 Peng Haitao wrote:
> When the watched file is deleted or renamed, the log will be made.
> You can get the result by following steps:
>
> 1. # service auditd start
> 2. # touch temp_file
> 3. # auditctl -w `pwd`/temp_file -k temp_file
> 4. # rm -f temp_file
>
> /var/log/audit/audit.log will contain:
> node=RHEL5.2GA type=CONFIG_CHANGE msg=audit(1217551948.386:97101):
> op=updated rules specifying path="/home/pht/temp_file" with dev=4294967295
> ino=4294967295 list=0 res=1
I am applying a patch that will allow parsing for missing auid fields in
CONFIG_CHANGE records. I think that is the only loose end to tie up on this
bug report.
-Steve
prev parent reply other threads:[~2008-08-15 18:04 UTC|newest]
Thread overview: 5+ messages / expand[flat|nested] mbox.gz Atom feed top
2008-07-29 5:40 [PATCH 1/2] fix a bug that use option '-r' cannot output all unformatted logs Peng Haitao
2008-07-29 10:07 ` Peng Haitao
2008-07-29 12:38 ` Steve Grubb
2008-07-30 1:06 ` Peng Haitao
2008-08-15 18:04 ` Steve Grubb [this message]
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=200808151404.33089.sgrubb@redhat.com \
--to=sgrubb@redhat.com \
--cc=linux-audit@redhat.com \
--cc=penght@cn.fujitsu.com \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.