From: John Feuerstein <john@feurix.com>
To: artem <artem@e-inet.ru>
Cc: linux-audit@redhat.com
Subject: Re: Audit Event Record Types
Date: Wed, 16 Nov 2011 14:45:19 +0100 [thread overview]
Message-ID: <20111116134518.GA5575@zombie.hq.fstein.net> (raw)
In-Reply-To: <4EC2DF5E.2000400@e-inet.ru>
Hi Artem,
run `ausearch -m` on your system, for example:
$ ausearch -m
Argument is required for -m
Valid message types are: ALL USER LOGIN USER_AUTH USER_ACCT USER_MGMT
CRED_ACQ CRED_DISP USER_START USER_END USER_AVC USER_CHAUTHTOK USER_ERR
CRED_REFR USYS_CONFIG USER_LOGIN USER_LOGOUT ADD_USER DEL_USER ADD_GROUP
DEL_GROUP DAC_CHECK CHGRP_ID TEST TRUSTED_APP USER_SELINUX_ERR USER_CMD
USER_TTY CHUSER_ID GRP_AUTH SYSTEM_BOOT SYSTEM_SHUTDOWN SYSTEM_RUNLEVEL
DAEMON_START DAEMON_END DAEMON_ABORT DAEMON_CONFIG DAEMON_ROTATE
DAEMON_RESUME DAEMON_ACCEPT DAEMON_CLOSE SYSCALL PATH IPC SOCKETCALL
CONFIG_CHANGE SOCKADDR CWD EXECVE IPC_SET_PERM MQ_OPEN MQ_SENDRECV
MQ_NOTIFY MQ_GETSETATTR KERNEL_OTHER FD_PAIR OBJ_PID TTY EOE BPRM_FCAPS
CAPSET AVC SELINUX_ERR AVC_PATH MAC_POLICY_LOAD MAC_STATUS
MAC_CONFIG_CHANGE MAC_UNLBL_ALLOW MAC_CIPSOV4_ADD MAC_CIPSOV4_DEL
MAC_MAP_ADD MAC_MAP_DEL MAC_IPSEC_ADDSA MAC_IPSEC_DELSA MAC_IPSEC_ADDSPD
MAC_IPSEC_DELSPD MAC_IPSEC_EVENT MAC_UNLBL_STCADD MAC_UNLBL_STCDEL
APPARMOR APPARMOR_AUDIT APPARMOR_ALLOWED APPARMOR_DENIED APPARMOR_HINT
APPARMOR_STATUS APPARMOR_ERROR ANOM_PROMISCUOUS ANOM_ABEND
INTEGRITY_DATA INTEGRITY_METADATA INTEGRITY_STATUS INTEGRITY_HASH
INTEGRITY_PCR INTEGRITY_RULE KERNEL ANOM_LOGIN_FAILURES ANOM_LOGIN_TIME
ANOM_LOGIN_SESSIONS ANOM_LOGIN_ACCT ANOM_LOGIN_LOCATION ANOM_MAX_DAC
ANOM_MAX_MAC ANOM_AMTU_FAIL ANOM_RBAC_FAIL ANOM_RBAC_INTEGRITY_FAIL
ANOM_CRYPTO_FAIL ANOM_ACCESS_FS ANOM_EXEC ANOM_MK_EXEC ANOM_ADD_ACCT
ANOM_DEL_ACCT ANOM_MOD_ACCT ANOM_ROOT_TRANS RESP_ANOMALY RESP_ALERT
RESP_KILL_PROC RESP_TERM_ACCESS RESP_ACCT_REMOTE RESP_ACCT_LOCK_TIMED
RESP_ACCT_UNLOCK_TIMED RESP_ACCT_LOCK RESP_TERM_LOCK RESP_SEBOOL
RESP_EXEC RESP_SINGLE RESP_HALT USER_ROLE_CHANGE ROLE_ASSIGN ROLE_REMOVE
LABEL_OVERRIDE LABEL_LEVEL_CHANGE USER_LABELED_EXPORT
USER_UNLABELED_EXPORT DEV_ALLOC DEV_DEALLOC FS_RELABEL
USER_MAC_POLICY_LOAD CRYPTO_TEST_USER CRYPTO_PARAM_CHANGE_USER
CRYPTO_LOGIN CRYPTO_LOGOUT CRYPTO_KEY_USER CRYPTO_FAILURE_USER
CRYPTO_REPLAY_USER CRYPTO_SESSION
Hope that helps,
John
next prev parent reply other threads:[~2011-11-16 13:45 UTC|newest]
Thread overview: 4+ messages / expand[flat|nested] mbox.gz Atom feed top
2011-11-15 21:53 Audit Event Record Types artem
2011-11-16 13:44 ` Steve Grubb
2011-11-16 13:45 ` John Feuerstein [this message]
-- strict thread matches above, loose matches on Subject: below --
2011-11-17 3:04 artem
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=20111116134518.GA5575@zombie.hq.fstein.net \
--to=john@feurix.com \
--cc=artem@e-inet.ru \
--cc=linux-audit@redhat.com \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox