From mboxrd@z Thu Jan  1 00:00:00 1970
From: Steve Grubb <sgrubb@redhat.com>
Subject: Re: Add a plugin
Date: Wed, 23 Dec 2009 08:33:50 -0500
Message-ID: <200912230833.50762.sgrubb@redhat.com>
References: <tencent_229DEEB73D8F9C9064E859CB@qq.com>
Mime-Version: 1.0
Content-Type: text/plain; charset="us-ascii"
Content-Transfer-Encoding: 7bit
Return-path: <linux-audit-bounces@redhat.com>
Received: from x2.localnet (vpn-10-233.rdu.redhat.com [10.11.10.233])
	by int-mx01.intmail.prod.int.phx2.redhat.com (8.13.8/8.13.8) with ESMTP
	id nBNDYDGi020236
	for <linux-audit@redhat.com>; Wed, 23 Dec 2009 08:34:13 -0500
In-Reply-To: <tencent_229DEEB73D8F9C9064E859CB@qq.com>
List-Unsubscribe: <https://www.redhat.com/mailman/options/linux-audit>,
	<mailto:linux-audit-request@redhat.com?subject=unsubscribe>
List-Archive: <https://www.redhat.com/archives/linux-audit>
List-Post: <mailto:linux-audit@redhat.com>
List-Help: <mailto:linux-audit-request@redhat.com?subject=help>
List-Subscribe: <https://www.redhat.com/mailman/listinfo/linux-audit>,
	<mailto:linux-audit-request@redhat.com?subject=subscribe>
Sender: linux-audit-bounces@redhat.com
Errors-To: linux-audit-bounces@redhat.com
To: linux-audit@redhat.com
List-Id: linux-audit@redhat.com

On Wednesday 23 December 2009 02:58:13 am Adan wrote:
>  Right now , I want to add it to the audit project to make it response to
>  the event at the same time. What should I do?

You need to take this file:

https://fedorahosted.org/audit/browser/trunk/contrib/plugin/audisp-example.conf

Fill it out with the path to your executable and set active to yes.
Then install it to /etc/audisp/plugins.d/  and restart the audit daemon.
You should be able to do a "ps -ef" and see your plugin is running.
The location that your plugin installs to should probably be /sbin
and if your plugin needs a configuration file, it could be located
anywhere inside /etc. I generally choose /etc/audisp for SE Linux
reasons, but you can put it anywhere.

-Steve