From mboxrd@z Thu Jan 1 00:00:00 1970 From: Steve Grubb Subject: Re: type=PROCTITLE events not being populated in /var/log/audit/audit.log Date: Wed, 10 Jan 2018 18:22:10 -0500 Message-ID: <12529563.ICzKhQbRlM@x2> References: Mime-Version: 1.0 Content-Type: text/plain; charset="us-ascii" Content-Transfer-Encoding: 7bit Return-path: In-Reply-To: List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Sender: linux-audit-bounces@redhat.com Errors-To: linux-audit-bounces@redhat.com To: linux-audit@redhat.com List-Id: linux-audit@redhat.com Hello, On Wednesday, January 10, 2018 5:41:03 PM EST Joshua Ammons wrote: > I wanted to check if anyone was aware of a setting on RedHat box for > enabling the PROCTITLE event type for audit logs? Nope. > Is there any difference between RedHat and CentOS? I have seen studies that show there are differences. > I have one box running RedHat 7.3 and another running CentOS 7.3, with > auditd enabled on both with the same rules. However, only the RedHat box is > populating the event type PROCTITLE - the CentOS box does not. You might move that box to Centos 7.4. The proctitle records was a kernel enhancement shipped in RHEL 7.4. -Steve > I would like to get the PROCTITLE event type working on my CentOS box as > well, if possible, but I cannot find any documentation online about anyone > else having this issue and how to resolve. > > Thanks for your time. > > Joshua Ammons Advanced SIEM Engineer, Cybersecurity > Global Business Services