From: Steve Grubb <sgrubb@redhat.com>
To: Peng Haitao <penght@cn.fujitsu.com>
Cc: audit-list <linux-audit@redhat.com>
Subject: Re: [PATCH 1/2] fix a bug that use option '-r' cannot output all unformatted logs
Date: Fri, 15 Aug 2008 14:04:32 -0400 [thread overview]
Message-ID: <200808151404.33089.sgrubb@redhat.com> (raw)
In-Reply-To: <488FBEA5.4080900@cn.fujitsu.com>
On Tuesday 29 July 2008 21:06:45 Peng Haitao wrote:
> When the watched file is deleted or renamed, the log will be made.
> You can get the result by following steps:
>
> 1. # service auditd start
> 2. # touch temp_file
> 3. # auditctl -w `pwd`/temp_file -k temp_file
> 4. # rm -f temp_file
>
> /var/log/audit/audit.log will contain:
> node=RHEL5.2GA type=CONFIG_CHANGE msg=audit(1217551948.386:97101):
> op=updated rules specifying path="/home/pht/temp_file" with dev=4294967295
> ino=4294967295 list=0 res=1
I am applying a patch that will allow parsing for missing auid fields in
CONFIG_CHANGE records. I think that is the only loose end to tie up on this
bug report.
-Steve
prev parent reply other threads:[~2008-08-15 18:04 UTC|newest]
Thread overview: 5+ messages / expand[flat|nested] mbox.gz Atom feed top
2008-07-29 5:40 [PATCH 1/2] fix a bug that use option '-r' cannot output all unformatted logs Peng Haitao
2008-07-29 10:07 ` Peng Haitao
2008-07-29 12:38 ` Steve Grubb
2008-07-30 1:06 ` Peng Haitao
2008-08-15 18:04 ` Steve Grubb [this message]
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=200808151404.33089.sgrubb@redhat.com \
--to=sgrubb@redhat.com \
--cc=linux-audit@redhat.com \
--cc=penght@cn.fujitsu.com \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox