From mboxrd@z Thu Jan 1 00:00:00 1970 From: Steve Grubb Subject: Re: Setting loginuid for a process starting at boot Date: Tue, 14 Jan 2014 11:15:51 -0500 Message-ID: <9789134.Zx7fPC2q5J@x2> References: <4604089.FuJBARoamI@x2> Mime-Version: 1.0 Content-Type: text/plain; charset="us-ascii" Content-Transfer-Encoding: 7bit Return-path: In-Reply-To: List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Sender: linux-audit-bounces@redhat.com Errors-To: linux-audit-bounces@redhat.com To: Maupertuis Philippe Cc: "linux-audit@redhat.com" List-Id: linux-audit@redhat.com On Tuesday, January 14, 2014 04:55:30 PM Maupertuis Philippe wrote: > Where can I find the description and the trigger of all messages types if > such a documentation exists ? To some extent, the documentation is in the header files. They describe what the intended use is for the event record types. https://fedorahosted.org/audit/browser/trunk/lib/libaudit.h#L40 https://git.kernel.org/cgit/linux/kernel/git/stable/linux-stable.git/tree/include/uapi/linux/audit.h?id=refs/tags/v3.12.7#n30 As for what triggers them, it can mostly be deduced from the event's type. However, some user space apps that do the same thing as others may not have been updated to do auditing and various distributions may or may not enable the auditing at build time. So, the user space support varies. -Steve