From mboxrd@z Thu Jan 1 00:00:00 1970 From: Burn Alting Subject: Re: Audit log Fields Date: Fri, 12 Feb 2016 00:06:54 +1100 Message-ID: <1455196014.28800.61.camel@swtf.swtf.dyndns.org> References: Reply-To: burn@swtf.dyndns.org Mime-Version: 1.0 Content-Type: text/plain; charset="us-ascii" Content-Transfer-Encoding: 7bit Return-path: Received: from mx1.redhat.com (ext-mx01.extmail.prod.ext.phx2.redhat.com [10.5.110.25]) by int-mx11.intmail.prod.int.phx2.redhat.com (8.14.4/8.14.4) with ESMTP id u1BD6wYb028554 (version=TLSv1/SSLv3 cipher=DHE-RSA-AES256-GCM-SHA384 bits=256 verify=NO) for ; Thu, 11 Feb 2016 08:06:58 -0500 Received: from swtf.swtf.dyndns.org (203-219-87-38.static.tpgi.com.au [203.219.87.38]) by mx1.redhat.com (Postfix) with ESMTP id 22B787AE94 for ; Thu, 11 Feb 2016 13:06:57 +0000 (UTC) Received: from localhost (localhost [127.0.0.1]) by swtf.swtf.dyndns.org (Postfix) with ESMTP id 52730301991BF for ; Fri, 12 Feb 2016 00:06:55 +1100 (AEDT) In-Reply-To: List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Sender: linux-audit-bounces@redhat.com Errors-To: linux-audit-bounces@redhat.com To: Sowndarya K Cc: Linux-audit@redhat.com List-Id: linux-audit@redhat.com Sowndarya, Are you are asking how do you propose another public field name to be added to the list in https://people.redhat.com/sgrubb/audit/audit-events.txt ? If so, I'd suggest you provide a. Proposed field name b. Description of it's content. c. Describe how it's going to be used. The list can then make comment and/or provide advice. Steve, Perhaps we could update the above document to advise users what they should offer in such a proposal. Perhaps further, we could offer a generic solution on how one could define a 'non-public' field name. That is, a 'non-public' field is one which could not, via it's nomenclature, conflict with a current or future 'public' (aka published) field name. Such non-public fields could then be used by capability that only needs the audit source and audit consumer to be aware of the field. Hopefully I am not reading too much into the original request. Regards On Thu, 2016-02-11 at 18:07 +0530, Sowndarya K wrote: > As of now there are so many proposed fields in the audit event log , > if I wanted to one proposed field which is of not use as much ,which > one can I chose for ? > -- > Linux-audit mailing list > Linux-audit@redhat.com > https://www.redhat.com/mailman/listinfo/linux-audit