From mboxrd@z Thu Jan 1 00:00:00 1970 From: Marcelo Cerri Subject: Re: [PATCH] auvirt: a new tool for reporting events related to virtual machines Date: Tue, 24 Jan 2012 16:33:15 -0200 Message-ID: <4F1EF96B.8040502@linux.vnet.ibm.com> References: <1323964611-30053-1-git-send-email-mhcerri@linux.vnet.ibm.com> <201112201318.16636.sgrubb@redhat.com> <4F05D389.8090808@linux.vnet.ibm.com> <201201111620.06515.sgrubb@redhat.com> <4F1EF3B8.5080303@linux.vnet.ibm.com> Mime-Version: 1.0 Content-Type: text/plain; charset="us-ascii"; Format="flowed" Content-Transfer-Encoding: 7bit Return-path: Received: from mx1.redhat.com (ext-mx12.extmail.prod.ext.phx2.redhat.com [10.5.110.17]) by int-mx11.intmail.prod.int.phx2.redhat.com (8.14.4/8.14.4) with ESMTP id q0OIXM5K028829 for ; Tue, 24 Jan 2012 13:33:22 -0500 Received: from e24smtp03.br.ibm.com (e24smtp03.br.ibm.com [32.104.18.24]) by mx1.redhat.com (8.14.4/8.14.4) with ESMTP id q0OIXKCN013348 for ; Tue, 24 Jan 2012 13:33:21 -0500 Received: from /spool/local by e24smtp03.br.ibm.com with IBM ESMTP SMTP Gateway: Authorized Use Only! Violators will be prosecuted for from ; Tue, 24 Jan 2012 16:33:19 -0200 In-Reply-To: <4F1EF3B8.5080303@linux.vnet.ibm.com> List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Sender: linux-audit-bounces@redhat.com Errors-To: linux-audit-bounces@redhat.com To: Steve Grubb Cc: linux-audit@redhat.com, gcwilson@us.ibm.com, bryntcor@us.ibm.com List-Id: linux-audit@redhat.com Maybe the session id? On 01/24/2012 04:08 PM, Marcelo Cerri wrote: > I took a look at some anomaly events and I'm thinking to correlate > them to guests based on the SELinux context or maybe based on the pid > field. > > Do you think there is another ways to correlate them? > > Regards, > Marcelo > > On 01/11/2012 07:20 PM, Steve Grubb wrote: >> On Thursday, January 05, 2012 11:44:57 AM Marcelo Cerri wrote: >>> But I'm not sure what means "anomaly events". Would it be malformed >>> records (without some fields, for example) or a specific record type >>> generated by the kernel or some other userspace application? >> No, these are events in the range of AUDIT_FIRST_ANOM_MSG and >> AUDIT_LAST_ANOM_MSG and some from the kernel in the range of >> AUDIT_FIRST_KERN_ANOM_MSG and AUDIT_LAST_KERN_ANOM_MSG. >> >> -Steve >> > > -- > Linux-audit mailing list > Linux-audit@redhat.com > https://www.redhat.com/mailman/listinfo/linux-audit >