From: Steve Grubb <sgrubb@redhat.com>
To: Ismail Yenigul <ismailyenigul@gmail.com>
Cc: linux-audit@redhat.com
Subject: Re: auditd 2.0.5 and 2.2 log format changes
Date: Tue, 20 May 2014 11:31:38 -0400 [thread overview]
Message-ID: <20140520113138.5e08d5e2@ivy-bridge> (raw)
In-Reply-To: <CAKpsdD0b0aXV1J-0y0WDudaKAGqUex204pSMQ1ebWtX3Jw3J6Q@mail.gmail.com>
On Tue, 20 May 2014 18:18:14 +0300
Ismail Yenigul <ismailyenigul@gmail.com> wrote:
> I have a scipt to correlate(for user friendly report) auditd 2.2
> version logs. It works on RedHat.
> We have suse 11.4 server running audit 2.0.5 version .
>
> I could not see any major log format difference between two version.
> I see that there is nametype=NORMAL field difference at the end of
> each line for version 2.2.
This is not related to auditd. This is a change in the kernel. Auditd
just distributes events to disk and other applications.
> Is there any other log format changes between two versions?
There are likely differences in the kernels (and possibly user space
apps). I have no idea what they are.
-Steve
next prev parent reply other threads:[~2014-05-20 15:31 UTC|newest]
Thread overview: 6+ messages / expand[flat|nested] mbox.gz Atom feed top
2014-05-20 15:18 auditd 2.0.5 and 2.2 log format changes Ismail Yenigul
2014-05-20 15:31 ` Steve Grubb [this message]
2014-05-20 15:35 ` Ismail Yenigul
2014-05-20 17:02 ` Eric Paris
2014-05-20 18:23 ` Ismail Yenigul
2014-05-20 18:38 ` Steve Grubb
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=20140520113138.5e08d5e2@ivy-bridge \
--to=sgrubb@redhat.com \
--cc=ismailyenigul@gmail.com \
--cc=linux-audit@redhat.com \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox