* datastructures sent by auditSubsystem to audit daemon
@ 2007-12-13 8:23 Abhishek Gupta
2007-12-13 11:35 ` Steve Grubb
0 siblings, 1 reply; 2+ messages in thread
From: Abhishek Gupta @ 2007-12-13 8:23 UTC (permalink / raw)
To: linux-audit
[-- Attachment #1.1: Type: text/plain, Size: 169 bytes --]
Which are the specific datastructures(containing various fields such as
events,etc) that is sent by auditSubsystem to audit daemon?
And in which file they are present..
[-- Attachment #1.2: Type: text/html, Size: 176 bytes --]
[-- Attachment #2: Type: text/plain, Size: 0 bytes --]
^ permalink raw reply [flat|nested] 2+ messages in thread
* Re: datastructures sent by auditSubsystem to audit daemon
2007-12-13 8:23 datastructures sent by auditSubsystem to audit daemon Abhishek Gupta
@ 2007-12-13 11:35 ` Steve Grubb
0 siblings, 0 replies; 2+ messages in thread
From: Steve Grubb @ 2007-12-13 11:35 UTC (permalink / raw)
To: linux-audit; +Cc: Abhishek Gupta
On Thursday 13 December 2007 03:23:34 Abhishek Gupta wrote:
> Which are the specific datastructures(containing various fields such as
> events,etc) that is sent by auditSubsystem to audit daemon?
Its not a data structure. The kernel sends a text string to the audit daemon
via the netlink interface. The audit daemon takes the message type number and
looks it up to get the text string for that type and substitutes that when it
writes to disk so that its a little more friendly to view.
> And in which file they are present..
Typically, they are written to /var/log/audit/audit.log. You can see the
messages there and they are basically unaltered.
-Steve
^ permalink raw reply [flat|nested] 2+ messages in thread
end of thread, other threads:[~2007-12-13 11:35 UTC | newest]
Thread overview: 2+ messages (download: mbox.gz follow: Atom feed
-- links below jump to the message on this page --
2007-12-13 8:23 datastructures sent by auditSubsystem to audit daemon Abhishek Gupta
2007-12-13 11:35 ` Steve Grubb
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox