From mboxrd@z Thu Jan 1 00:00:00 1970 From: "Boyce, Kevin P (AS)" Subject: RE: How to make sure a specific event is logged with thge proper message type? Date: Mon, 6 Jul 2015 15:08:12 +0000 Message-ID: <4c840ecade994277bfdf313c6edcc6d3@XCGVAG30.northgrum.com> References: <23396023F719ED41888885C3B22D602F0154BB@WPEXCH2010MR11.bur.hydro.qc.ca> Mime-Version: 1.0 Content-Type: multipart/mixed; boundary="===============1764118002276659168==" Return-path: Received: from mx1.redhat.com (ext-mx06.extmail.prod.ext.phx2.redhat.com [10.5.110.30]) by int-mx11.intmail.prod.int.phx2.redhat.com (8.14.4/8.14.4) with ESMTP id t66FACOf021928 (version=TLSv1/SSLv3 cipher=DHE-RSA-AES256-GCM-SHA384 bits=256 verify=NO) for ; Mon, 6 Jul 2015 11:10:12 -0400 Received: from xspv0103.northgrum.com (xspv0103.northgrum.com [134.223.120.78]) by mx1.redhat.com (Postfix) with ESMTPS id B7FC8389DBD for ; Mon, 6 Jul 2015 15:10:09 +0000 (UTC) In-Reply-To: <23396023F719ED41888885C3B22D602F0154BB@WPEXCH2010MR11.bur.hydro.qc.ca> Content-Language: en-US List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Sender: linux-audit-bounces@redhat.com Errors-To: linux-audit-bounces@redhat.com To: "Alarie, Maxime" , "linux-audit@redhat.com" List-Id: linux-audit@redhat.com --===============1764118002276659168== Content-Language: en-US Content-Type: multipart/alternative; boundary="_000_4c840ecade994277bfdf313c6edcc6d3XCGVAG30northgrumcom_" --_000_4c840ecade994277bfdf313c6edcc6d3XCGVAG30northgrumcom_ Content-Type: text/plain; charset="us-ascii" Content-Transfer-Encoding: quoted-printable OK this may be obvious but have you actually tried using useradd to create = an account before running your ausearch? From: linux-audit-bounces@redhat.com [mailto:linux-audit-bounces@redhat.com= ] On Behalf Of Alarie, Maxime Sent: Monday, July 06, 2015 10:03 AM To: linux-audit@redhat.com Subject: EXT :How to make sure a specific event is logged with thge proper = message type? Hi, I have this rule in audit.rules : -w /usr/sbin/useradd -p x -k user_modific= ation When I add a user, and do a ausearch -m ADD_USER I get 0 match. Am I doi= ng something wrong here? I am using version 1.8. Thanks --_000_4c840ecade994277bfdf313c6edcc6d3XCGVAG30northgrumcom_ Content-Type: text/html; charset="us-ascii" Content-Transfer-Encoding: quoted-printable

OK this may be obvious= but have you actually tried using useradd to create an account before runn= ing your ausearch?

From: linux-au= dit-bounces@redhat.com [mailto:linux-audit-bounces@redhat.com] On Behalf Of Alarie, Maxime
Sent: Monday, July 06, 2015 10:03 AM
To: linux-audit@redhat.com
Subject: EXT :How to make sure a specific event is logged with thge = proper message type?

Hi,

I have this rule in audit.rules= : -w /usr/sbin/useradd -p x -k user_modification

When I add a user, and do a aus= earch –m ADD_USER I get 0 match. Am I doing somethi= ng wrong here? I am using version 1.8.

=
Thanks

--_000_4c840ecade994277bfdf313c6edcc6d3XCGVAG30northgrumcom_-- --===============1764118002276659168== Content-Type: text/plain; charset="us-ascii" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit Content-Disposition: inline --===============1764118002276659168==--