From mboxrd@z Thu Jan 1 00:00:00 1970 From: Steve Subject: Re: Monitoring events Date: Thu, 08 Jun 2006 10:22:09 -0400 Message-ID: <44883291.90804@ornl.gov> References: <44882C43.70704@ornl.gov> <200606081004.16261.sgrubb@redhat.com> Mime-Version: 1.0 Content-Type: text/plain; charset=iso-8859-1; format=flowed Content-Transfer-Encoding: 7bit Return-path: Received: from mx1.redhat.com (mx1.redhat.com [172.16.48.31]) by int-mx1.corp.redhat.com (8.12.11.20060308/8.12.11) with ESMTP id k58EMH37020472 for ; Thu, 8 Jun 2006 10:22:17 -0400 Received: from emroute2.ornl.gov (emroute2.ornl.gov [160.91.86.17]) by mx1.redhat.com (8.12.11.20060308/8.12.11) with ESMTP id k58EMEDO017106 for ; Thu, 8 Jun 2006 10:22:15 -0400 Received: from emroute2.ornl.gov (localhost [127.0.0.1]) by emroute2.ornl.gov (PMDF V6.2-1x9 #31038) with ESMTP id <0J0J00D3YP92FU@emroute2.ornl.gov> for linux-audit@redhat.com; Thu, 08 Jun 2006 10:22:14 -0400 (EDT) Received: from ORNLEXCHANGE.ornl.gov (ornlexchange1.ornl.gov [160.91.1.20]) by emroute2.ornl.gov (PMDF V6.2-1x9 #31038) with ESMTP id <0J0J00D2RP92V1@emroute2.ornl.gov> for linux-audit@redhat.com; Thu, 08 Jun 2006 10:22:14 -0400 (EDT) In-reply-to: <200606081004.16261.sgrubb@redhat.com> List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Sender: linux-audit-bounces@redhat.com Errors-To: linux-audit-bounces@redhat.com To: linux-audit@redhat.com Cc: Steve List-Id: linux-audit@redhat.com >> Ideally, I would like to only capture (or parse) events pertaining to >> rules I have created (since other system processes are using auditd as >> well). Is there's any kind of identifier that ties events to rules? > Which kernel are you using? Are your events only watches or do you care about > syscall auditing as well (meaning you have set some syscall audit rules) ? kernel-2.6.16-1.2212.2.8_FC6.lspp.34.i686 on Fedora Core 5 At the moment they are only watches, I may add others (syscall rules) later. Thanks again, Steve