Re: Monitoring events

[Steve Grubb <sgrubb@redhat.com>]

On Thursday 08 June 2006 10:22, Steve wrote:
> >> Ideally, I would like to only capture (or parse) events pertaining to
> >> rules I have created (since other system processes are using auditd as
> >> well).  Is there's any kind of identifier that ties events to rules?
> >
> > Which kernel are you using? Are your events only watches or do you care
> > about syscall auditing as well (meaning you have set some syscall audit
> > rules) ?
>
> kernel-2.6.16-1.2212.2.8_FC6.lspp.34.i686 on Fedora Core 5
>
> At the moment they are only watches,

OK, the lspp series (so far) does not support the idea of a "key tag" as RHEL4 
did. The key would have allowed you to recognize events you are interested 
in. That said, you can look for events that have an AUDIT_PATH record in 
them. Those would likely be yours.

> I may add others (syscall rules) later.

That would complicate the analysis somewhat. But you could still do it. You 
can also look over the list of message types and see which ones you do not 
want and reject those early in the filtering.

-Steve