From: Steve Grubb <sgrubb@redhat.com>
To: linux-audit@redhat.com
Cc: kunal chandarana <chandarana.kunal@gmail.com>
Subject: Re: Linux-audit Digest, Vol 40, Issue 9
Date: Wed, 16 Jan 2008 08:59:45 -0500 [thread overview]
Message-ID: <200801160859.45468.sgrubb@redhat.com> (raw)
In-Reply-To: <770716a30801152259l3b97d79crea2de5bd66033d1e@mail.gmail.com>
On Wednesday 16 January 2008 01:59:34 kunal chandarana wrote:
> Is there a way to map this audit type to the fields.
I don't have a map of each type. They can all be found by code inspection. For
kernel, I'd recommend using LXR.
http://lxr.linux.no/linux/include/linux/audit.h
Look at explanation about ranges. Look for kernel record types and click on
the define to see where they are used. From that you can click to the code
that uses it.
Alternatively, you could run one of the audit test suites and then maybe see
what each audit record looks like.
-Steve
prev parent reply other threads:[~2008-01-16 13:59 UTC|newest]
Thread overview: 3+ messages / expand[flat|nested] mbox.gz Atom feed top
[not found] <20080114170028.0385D73507@hormel.redhat.com>
2008-01-16 6:59 ` Linux-audit Digest, Vol 40, Issue 9 kunal chandarana
2008-01-16 12:27 ` John Dennis
2008-01-16 13:59 ` Steve Grubb [this message]
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=200801160859.45468.sgrubb@redhat.com \
--to=sgrubb@redhat.com \
--cc=chandarana.kunal@gmail.com \
--cc=linux-audit@redhat.com \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox