Re: Audit format utility

[Steve Grubb <sgrubb@redhat.com>]

Hello,

On Thu, 25 Sep 2014 11:16:33 -0500
LC Bruzenak <lenny@magitekltd.com> wrote:
> On 09/23/2014 05:03 PM, Steve Grubb wrote:
> > Hello,
> >
> > I have been doing some thinking about allowing user defined formats
> > to be declared as a parameter to ausearch. Before I commit to that,
> > I thought it might be interesting to create a "mockup". I have
> > placed a utility here:
> >
> Steve,
> 
> I'll be testing this ASAP to see what shakes out for me.
> For user-defined formats, are you thinking maybe along the lines of
> allowing a regexp ability to ausearch which would be like the
> ausearch-expression capability in libauparse?

Not exactly. A regex would be for searching for events that match some
criteria. That might be useful in and of itself. What this proposal is
about is allowing one to specify how an event is output. For example,
you may want some kind of xml looking thing. Or maybe html, or maybe
json looking. Or maybe you just want it your way...just because.

I know one of the limitations is that each event is unique. I am
planning to address this in the near future by having a classifier that
you just ask, what is the subject, what is the object, what was the
action, what was the result. It would supply the answer. Then I could
go back to this and add some new classifier virtual fields that could
be $SUBJECT, $OBJECT, etc.

But this proposal is purely about output and not searching.

-Steve