* Definitive guide for audit message types @ 2014-10-10 16:58 William Roberts 2014-10-11 22:01 ` Steve Grubb 0 siblings, 1 reply; 2+ messages in thread From: William Roberts @ 2014-10-10 16:58 UTC (permalink / raw) To: linux-audit@redhat.com For audit log records, the type field can be something like 1400 for an AVC event. I know on the desktop it formats these all to the pretty names IIRC, however I am on Android and were not quite as advanced yet. Is their a definitive guide for each number what they correspond to besides cracking open the header files? Thanks. -- Respectfully, William C Roberts ^ permalink raw reply [flat|nested] 2+ messages in thread
* Re: Definitive guide for audit message types 2014-10-10 16:58 Definitive guide for audit message types William Roberts @ 2014-10-11 22:01 ` Steve Grubb 0 siblings, 0 replies; 2+ messages in thread From: Steve Grubb @ 2014-10-11 22:01 UTC (permalink / raw) To: William Roberts; +Cc: linux-audit@redhat.com On Fri, 10 Oct 2014 09:58:48 -0700 William Roberts <bill.c.roberts@gmail.com> wrote: > For audit log records, the type field can be something like 1400 for > an AVC event. I know on the desktop it formats these all to the pretty > names IIRC, however I am on Android and were not quite as advanced > yet. Is their a definitive guide for each number what they correspond > to besides cracking open the header files? The kernel headers and libaudit headers are the literal definitive source. They can be seen here: https://git.kernel.org/cgit/linux/kernel/git/stable/linux-stable.git/tree/include/uapi/linux/audit.h?id=refs/tags/v3.16.5#n30 and https://fedorahosted.org/audit/browser/trunk/lib/libaudit.h#L40 -Steve ^ permalink raw reply [flat|nested] 2+ messages in thread
end of thread, other threads:[~2014-10-11 22:01 UTC | newest] Thread overview: 2+ messages (download: mbox.gz follow: Atom feed -- links below jump to the message on this page -- 2014-10-10 16:58 Definitive guide for audit message types William Roberts 2014-10-11 22:01 ` Steve Grubb
This is a public inbox, see mirroring instructions for how to clone and mirror all data and code used for this inbox