From mboxrd@z Thu Jan 1 00:00:00 1970 From: Steve Grubb Subject: Re: the meaning of this audit entry Date: Tue, 20 Nov 2007 21:27:18 -0500 Message-ID: <200711202127.18447.sgrubb@redhat.com> References: <12635.72.245.30.196.1195507332.squirrel@aa.usno.navy.mil> <1195510425.6013.16.camel@localhost.localdomain> <1763.10.1.5.75.1195571288.squirrel@aa.usno.navy.mil> Mime-Version: 1.0 Content-Type: text/plain; charset="iso-8859-1" Content-Transfer-Encoding: 7bit Return-path: In-Reply-To: <1763.10.1.5.75.1195571288.squirrel@aa.usno.navy.mil> Content-Disposition: inline List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Sender: linux-audit-bounces@redhat.com Errors-To: linux-audit-bounces@redhat.com To: linux-audit@redhat.com List-Id: linux-audit@redhat.com On Tuesday 20 November 2007 10:08:08 am Bill Tangren wrote: > Well, I'm just finding that out. Obviously I have to rewrite all my rules, > or most of them, anyway. I'd like to blame someone else for the rules, > since I was given these and told to use them, but I should know better. > Obviously I have a lot to learn. I wish there was a tutorial or something > I could read. I've gone over the man page, but I'm not learning enough > from it. Take a look at the capp.rules or nispom.rules file in the audit package. Those are real working rules that have been commented. That is where I would start if I were setting up a system. > I'll star by splitting up the auid= rules, and observe what shows up in > the logs. I think your issues are more fundamental than that. I think you have more rules than you shared with us and they are looking for unsuccessful calls and not considering the exit codes. There are plenty of people on this mail list that could help you with your rules if you told us what kinds of things you were needing to audit. -Steve