ausearch message types

ausearch message types

[LC Bruzenak]

I'm on the 2.4.5 version of the audit code.
Has anyone thought about or implemented a exclusionary message list, 
such as:

ausearch -m ALL-avc,user_avc -ts today

I'd like to be able to search in this manner, where I exclude certain 
message types.
I could write a patch, but if anyone has already done this I'd happily 
use theirs.
The message type list is so long that it would be painful to have the 
comma-delimited list of all but a couple.

Thx,
LCB

-- 
LC Bruzenak
magitekltd.com

Re: ausearch message types

[LC Bruzenak]

On 10/31/2016 04:21 PM, LC Bruzenak wrote:
> I'm on the 2.4.5 version of the audit code.
> Has anyone thought about or implemented a exclusionary message list, 
> such as:
>
> ausearch -m ALL-avc,user_avc -ts today

Actually in this case I'm running the search from a script so I can 
easily take the stderr results from "ausearch -i -m help", pipe them 
into a sed substitution which removes the preceding text, removes the 
ones I don't want, and replaces the spaces with commas.
So for now I am set; still I think it would perhaps be helpful to have 
at some point.

-- 
LC Bruzenak
magitekltd.com

Ausearch message types

[Steve M. Zak]

Hi,

Where can I find a definition list for the ausearch message types?  I didn't find anything on google or in the man page.

Steve Grubb referenced -m RESP_ACC_LOCK (account lockout) and -m USER_AUTH (user authentication)

I'd like to know what the other ones can do.

Thanks!


____________________________________________
Steve M. Zak, 



-- 
This email was Anti Virus checked by Astaro Security Gateway. http://www.astaro.com

Re: Ausearch message types

[Steve Grubb]

On Tuesday, April 12, 2011 06:59:59 PM Steve M. Zak wrote:
> Where can I find a definition list for the ausearch message types?  I
> didn't find anything on google or in the man page.

There is some text in the header files. Maybe not the ideal location but its there so
programmers have it when they look at the possible definitions. The main difference
between the headers and ausearch is ausearch does not make you type the AUDIT_ prefix.

https://fedorahosted.org/audit/browser/trunk/lib/libaudit.h#L40

http://git.kernel.org/?p=linux/kernel/git/torvalds/linux-2.6.git;a=blob;f=include/linux/audit.h;h=9d339eb278810a36e8549bad93954f8d31636f44;hb=HEAD

-Steve