From: Steve Grubb <sgrubb@redhat.com>
To: Florian Crouzat <tech@floriancrouzat.net>
Cc: linux-audit@redhat.com
Subject: Re: auditd on nonexistent files
Date: Fri, 18 Sep 2015 01:22:06 +0100 [thread overview]
Message-ID: <20150918012206.65b9fb5d@ivy-bridge> (raw)
In-Reply-To: <55F920CA.8020703@floriancrouzat.net>
On Wed, 16 Sep 2015 09:56:58 +0200
Florian Crouzat <tech@floriancrouzat.net> wrote:
> I asked the same question in the "Watching over non-existent folder to
> maintain a generic audit.rules file" thread but got different hints.
> I've been directed to augenrules which could help but this doesn't
> really match or facilitate my needs to replace my current FIM tool by
> auditd which requires me to write a generic configuration with all
> possibles folders (including applicative ones) and deploy accross all
> hosts without knowing which host runs which app and/or contains which
> folders.
That is not the intended way to use augenrules. The intention is to have
a base set of rules that apply to everything. Then drop in rules that
apply to that type of system. IOW, you would not put apache rules
on your DNS system because that doesn't make sense.
-Steve
prev parent reply other threads:[~2015-09-18 0:22 UTC|newest]
Thread overview: 6+ messages / expand[flat|nested] mbox.gz Atom feed top
2015-09-14 16:01 auditd on nonexistent files Davíð Steinn Geirsson
2015-09-15 9:15 ` Steve Grubb
2015-09-15 9:25 ` Davíð Steinn Geirsson
2015-09-15 10:07 ` Richard Guy Briggs
2015-09-16 7:56 ` Florian Crouzat
2015-09-18 0:22 ` Steve Grubb [this message]
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=20150918012206.65b9fb5d@ivy-bridge \
--to=sgrubb@redhat.com \
--cc=linux-audit@redhat.com \
--cc=tech@floriancrouzat.net \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox