From mboxrd@z Thu Jan 1 00:00:00 1970 From: "Brown, Curtis (cbrown31)" Subject: User msg in Audit Viewer Date: Mon, 25 Feb 2013 20:41:21 +0000 Message-ID: <8577AE9A01979D4F88FD6AB101522AD642256F61@ROCMXUS22.cs.myharris.net> Mime-Version: 1.0 Content-Type: multipart/mixed; boundary="===============9181182783535000326==" Return-path: Received: from mx1.redhat.com (ext-mx12.extmail.prod.ext.phx2.redhat.com [10.5.110.17]) by int-mx02.intmail.prod.int.phx2.redhat.com (8.13.8/8.13.8) with ESMTP id r1PKfQjj009030 for ; Mon, 25 Feb 2013 15:41:26 -0500 Received: from mlbefw2.harris.com (mlbefw2.harris.com [192.52.233.80]) by mx1.redhat.com (8.14.4/8.14.4) with ESMTP id r1PKfNlC002834 for ; Mon, 25 Feb 2013 15:41:24 -0500 Content-Language: en-US List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Sender: linux-audit-bounces@redhat.com Errors-To: linux-audit-bounces@redhat.com To: "linux-audit@redhat.com" List-Id: linux-audit@redhat.com --===============9181182783535000326== Content-Language: en-US Content-Type: multipart/alternative; boundary="_000_8577AE9A01979D4F88FD6AB101522AD642256F61ROCMXUS22csmyha_" --_000_8577AE9A01979D4F88FD6AB101522AD642256F61ROCMXUS22csmyha_ Content-Type: text/plain; charset="us-ascii" Content-Transfer-Encoding: quoted-printable I don't know if this the correct forum for questions about the Audit Viewer= but here goes. I wrote a test app to write an audit user message (audit_log_user_message).= This is successful. I'm trying to display the msg=3D"" portion of the audit record in Audit Vie= wer without success. The msg portion doesn't show up in the "Other Fields" displayed by Audit V= iewer but is present in the actual audit record. Any help would be appreciated or please point me to a forum that can answer= my question. --_000_8577AE9A01979D4F88FD6AB101522AD642256F61ROCMXUS22csmyha_ Content-Type: text/html; charset="us-ascii" Content-Transfer-Encoding: quoted-printable
I don’t know if this the correct forum for questions about the A= udit Viewer but here goes.
 
I wrote a test app to write an audit user message (audit_log_user_mess= age).  This is successful.
 
I’m trying to display the msg=3D”” portion of the au= dit record in Audit Viewer without success.
 
The msg portion doesn’t show up in the “Other Fields”= ;  displayed by Audit Viewer but is present in the actual audit record= .
 
Any help would be appreciated or please point me to a forum that can a= nswer my question.
 
 --_000_8577AE9A01979D4F88FD6AB101522AD642256F61ROCMXUS22csmyha_-- --===============9181182783535000326== Content-Type: text/plain; charset="us-ascii" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit Content-Disposition: inline --===============9181182783535000326==-- From mboxrd@z Thu Jan 1 00:00:00 1970 From: Miloslav Trmac Subject: Re: User msg in Audit Viewer Date: Tue, 26 Feb 2013 04:29:28 -0500 (EST) Message-ID: <64989492.8484233.1361870968515.JavaMail.root@redhat.com> References: <8577AE9A01979D4F88FD6AB101522AD642256F61@ROCMXUS22.cs.myharris.net> Mime-Version: 1.0 Content-Type: multipart/mixed; boundary="===============7139229932146016577==" Return-path: Received: from mx3-phx2.redhat.com (mx01.colomx.prod.int.phx2.redhat.com [10.5.7.1]) by int-mx12.intmail.prod.int.phx2.redhat.com (8.14.4/8.14.4) with ESMTP id r1Q9TS6n008198 for ; Tue, 26 Feb 2013 04:29:28 -0500 In-Reply-To: <8577AE9A01979D4F88FD6AB101522AD642256F61@ROCMXUS22.cs.myharris.net> List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Sender: linux-audit-bounces@redhat.com Errors-To: linux-audit-bounces@redhat.com To: "Curtis Brown (cbrown31)" Cc: linux-audit@redhat.com List-Id: linux-audit@redhat.com --===============7139229932146016577== Content-Type: multipart/alternative; boundary="----=_Part_8484232_1092562491.1361870968514" ------=_Part_8484232_1092562491.1361870968514 Content-Type: text/plain; charset=utf-8 Content-Transfer-Encoding: quoted-printable Hello,=20 can you please attach a sample (possibly one-line) log file?=20 Thank you,=20 Mirek=20 ----- Original Message ----- > I don=E2=80=99t know if this the correct forum for questions about the Au= dit > Viewer but here goes. > I wrote a test app to write an audit user message > (audit_log_user_message). This is successful. > I=E2=80=99m trying to display the msg=3D=E2=80=9D=E2=80=9D portion of the= audit record in Audit > Viewer without success. > The msg portion doesn=E2=80=99t show up in the =E2=80=9COther Fields=E2= =80=9D displayed by > Audit Viewer but is present in the actual audit record. > Any help would be appreciated or please point me to a forum that can > answer my question. > -- > Linux-audit mailing list > Linux-audit@redhat.com > https://www.redhat.com/mailman/listinfo/linux-audit ------=_Part_8484232_1092562491.1361870968514 Content-Type: text/html; charset=utf-8 Content-Transfer-Encoding: quoted-printable <= div style=3D'font-family: times new roman,new york,times,serif; font-size: = 12pt; color: #000000'>Hello,
can you please attach a sample (possibly on= e-line) log file?

Thank you,
   Mirek

I don=E2=80=99t know if this the correct forum for questions about the= Audit Viewer but here goes.
 
I wrote a test app to write an audit user message (audit_log_user_mess= age).  This is successful.
 
I=E2=80=99m trying to display the msg=3D=E2=80=9D=E2=80=9D portion of = the audit record in Audit Viewer without success.
 
The msg portion doesn=E2=80=99t show up in the =E2=80=9COther Fields= =E2=80=9D  displayed by Audit Viewer but is present in the actual audi= t record.
 
Any help would be appreciated or please point me to a forum that can a= nswer my question.
 
--
Linux-audit mailing list
Linux-audit@redhat.com
https://www= .redhat.com/mailman/listinfo/linux-audit

------=_Part_8484232_1092562491.1361870968514-- --===============7139229932146016577== Content-Type: text/plain; charset="us-ascii" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit Content-Disposition: inline --===============7139229932146016577==-- From mboxrd@z Thu Jan 1 00:00:00 1970 From: "Brown, Curtis (cbrown31)" Subject: RE: User msg in Audit Viewer Date: Tue, 26 Feb 2013 17:19:18 +0000 Message-ID: <8577AE9A01979D4F88FD6AB101522AD642257165@ROCMXUS22.cs.myharris.net> References: <8577AE9A01979D4F88FD6AB101522AD642256F61@ROCMXUS22.cs.myharris.net>, <64989492.8484233.1361870968515.JavaMail.root@redhat.com> Mime-Version: 1.0 Content-Type: text/plain; charset="windows-1252" Content-Transfer-Encoding: quoted-printable Return-path: In-Reply-To: <64989492.8484233.1361870968515.JavaMail.root@redhat.com> Content-Language: en-US List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Sender: linux-audit-bounces@redhat.com Errors-To: linux-audit-bounces@redhat.com To: Miloslav Trmac Cc: "linux-audit@redhat.com" List-Id: linux-audit@redhat.com I actually figured it out yesterday. I just need to add name=3Dvalue pairs= as text in the user msg to be interpreted by Audit Viewer. Thanks for the quick response. ________________________________ From: Miloslav Trmac [mitr@redhat.com] Sent: Tuesday, February 26, 2013 2:29 AM To: Brown, Curtis (cbrown31) Cc: linux-audit@redhat.com Subject: Re: User msg in Audit Viewer Hello, can you please attach a sample (possibly one-line) log file? Thank you, Mirek ________________________________ I don=92t know if this the correct forum for questions about the Audit View= er but here goes. I wrote a test app to write an audit user message (audit_log_user_message).= This is successful. I=92m trying to display the msg=3D=94=94 portion of the audit record in Aud= it Viewer without success. The msg portion doesn=92t show up in the =93Other Fields=94 displayed by A= udit Viewer but is present in the actual audit record. Any help would be appreciated or please point me to a forum that can answer= my question. -- Linux-audit mailing list Linux-audit@redhat.com https://www.redhat.com/mailman/listinfo/linux-audit