From mboxrd@z Thu Jan 1 00:00:00 1970 From: Steve Subject: Monitoring events Date: Thu, 08 Jun 2006 09:55:15 -0400 Message-ID: <44882C43.70704@ornl.gov> Mime-Version: 1.0 Content-Type: text/plain; charset=ISO-8859-1; format=flowed Content-Transfer-Encoding: 7bit Return-path: Received: from mx1.redhat.com (mx1.redhat.com [172.16.48.31]) by int-mx1.corp.redhat.com (8.12.11.20060308/8.12.11) with ESMTP id k58DtKd3013197 for ; Thu, 8 Jun 2006 09:55:20 -0400 Received: from emroute4.ornl.gov (emroute4.ornl.gov [160.91.86.27]) by mx1.redhat.com (8.12.11.20060308/8.12.11) with ESMTP id k58DtKaN002334 for ; Thu, 8 Jun 2006 09:55:20 -0400 Received: from emroute4.ornl.gov (localhost [127.0.0.1]) by emroute4.ornl.gov (PMDF V6.2-1x9 #31038) with ESMTP id <0J0J00G48O0779@emroute4.ornl.gov> for linux-audit@redhat.com; Thu, 08 Jun 2006 09:55:19 -0400 (EDT) Received: from ORNLEXCHANGE.ornl.gov (ornlexchange1.ornl.gov [160.91.1.20]) by emroute4.ornl.gov (PMDF V6.2-1x9 #31038) with ESMTP id <0J0J00F5SO07WB@emroute4.ornl.gov> for linux-audit@redhat.com; Thu, 08 Jun 2006 09:55:19 -0400 (EDT) List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Sender: linux-audit-bounces@redhat.com Errors-To: linux-audit-bounces@redhat.com To: linux-audit@redhat.com List-Id: linux-audit@redhat.com I have the program adding rules to Audit now. Thank you for your help. I also have my program monitoring the output from auditd (via the dispatch option in auditd.conf). Ideally, I would like to only capture (or parse) events pertaining to rules I have created (since other system processes are using auditd as well). Is there's any kind of identifier that ties events to rules? Thank you again, Steve