From mboxrd@z Thu Jan 1 00:00:00 1970 From: Steve Grubb Subject: Re: Monitoring events Date: Thu, 8 Jun 2006 10:39:07 -0400 Message-ID: <200606081039.07731.sgrubb@redhat.com> References: <44882C43.70704@ornl.gov> <200606081004.16261.sgrubb@redhat.com> <44883291.90804@ornl.gov> Mime-Version: 1.0 Content-Type: text/plain; charset="iso-8859-1" Content-Transfer-Encoding: 7bit Return-path: In-Reply-To: <44883291.90804@ornl.gov> Content-Disposition: inline List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Sender: linux-audit-bounces@redhat.com Errors-To: linux-audit-bounces@redhat.com To: linux-audit@redhat.com Cc: Steve List-Id: linux-audit@redhat.com On Thursday 08 June 2006 10:22, Steve wrote: > >> Ideally, I would like to only capture (or parse) events pertaining to > >> rules I have created (since other system processes are using auditd as > >> well). Is there's any kind of identifier that ties events to rules? > > > > Which kernel are you using? Are your events only watches or do you care > > about syscall auditing as well (meaning you have set some syscall audit > > rules) ? > > kernel-2.6.16-1.2212.2.8_FC6.lspp.34.i686 on Fedora Core 5 > > At the moment they are only watches, OK, the lspp series (so far) does not support the idea of a "key tag" as RHEL4 did. The key would have allowed you to recognize events you are interested in. That said, you can look for events that have an AUDIT_PATH record in them. Those would likely be yours. > I may add others (syscall rules) later. That would complicate the analysis somewhat. But you could still do it. You can also look over the list of message types and see which ones you do not want and reject those early in the filtering. -Steve