From mboxrd@z Thu Jan  1 00:00:00 1970
From: Steve Grubb <sgrubb@redhat.com>
Subject: Re: creating and inserting audits
Date: Tue, 7 Sep 2010 17:17:23 -0400
Message-ID: <201009071717.24180.sgrubb@redhat.com>
References: <43782B27EE6B5749BBC041BF2AD5ACA429EE09DBD3@01AESMX09-1.aes.de.ittind.com>
	<1283893341.4286.10.camel@lcb>
Mime-Version: 1.0
Content-Type: text/plain; charset="us-ascii"
Content-Transfer-Encoding: 7bit
Return-path: <linux-audit-bounces@redhat.com>
In-Reply-To: <1283893341.4286.10.camel@lcb>
List-Unsubscribe: <https://www.redhat.com/mailman/options/linux-audit>,
	<mailto:linux-audit-request@redhat.com?subject=unsubscribe>
List-Archive: <https://www.redhat.com/archives/linux-audit>
List-Post: <mailto:linux-audit@redhat.com>
List-Help: <mailto:linux-audit-request@redhat.com?subject=help>
List-Subscribe: <https://www.redhat.com/mailman/listinfo/linux-audit>,
	<mailto:linux-audit-request@redhat.com?subject=subscribe>
Sender: linux-audit-bounces@redhat.com
Errors-To: linux-audit-bounces@redhat.com
To: linux-audit@redhat.com
List-Id: linux-audit@redhat.com

On Tuesday, September 07, 2010 05:02:21 pm LC Bruzenak wrote:
> > Is it a bad idea to build and then to insert a custom audit/message,
> > or any standard audit, into the audit.log file?
> 
> Nope.

To make sure we don't give conflicting advice, I was thinking he meant writing 
directly to the file (which you should not do). Events must be sent to the 
kernel. But you are free to make your own audit events as long as you mimic 
the existing events.

-Steve