From mboxrd@z Thu Jan 1 00:00:00 1970 From: Mike Nixon Subject: Re: buffer space Date: Mon, 17 Aug 2009 12:58:57 -0400 Message-ID: References: <200908131428.52924.sgrubb@redhat.com> <4A897884.6030703@conceras.com> Mime-Version: 1.0 Content-Type: multipart/mixed; boundary=00235407f00653dd7a047159511e Return-path: Received: from mx1.redhat.com (mx1.redhat.com [172.16.48.31]) by int-mx1.corp.redhat.com (8.13.1/8.13.1) with ESMTP id n7HGxBIK010035 for ; Mon, 17 Aug 2009 12:59:11 -0400 Received: from mail-fx0-f228.google.com (mail-fx0-f228.google.com [209.85.220.228]) by mx1.redhat.com (8.13.8/8.13.8) with ESMTP id n7HGwviL012814 for ; Mon, 17 Aug 2009 12:58:57 -0400 Received: by fxm28 with SMTP id 28so2424403fxm.41 for ; Mon, 17 Aug 2009 09:58:57 -0700 (PDT) In-Reply-To: <4A897884.6030703@conceras.com> List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Sender: linux-audit-bounces@redhat.com Errors-To: linux-audit-bounces@redhat.com To: "Norman Mark St. Laurent" Cc: linux-audit@redhat.com List-Id: linux-audit@redhat.com --00235407f00653dd7a047159511e Content-Type: multipart/alternative; boundary=00235407f00653dd71047159511c --00235407f00653dd71047159511c Content-Type: text/plain; charset=ISO-8859-1 Content-Transfer-Encoding: 7bit Attached are is the audit.rules file from SECSCN 4.3. There is a v4.4 now available but I don't have it handy. Also attached are two docs which explain SECSCN's auditd configuration expectations. -Mike On Mon, Aug 17, 2009 at 11:34 AM, Norman Mark St. Laurent < mstlaurent@conceras.com> wrote: > Hi David, > > I too would like to know what version of SECSCAN you are using for the > "required watches". I run the STIGS, SECSCAN, and a myriad of vulnerability > analysis tools (outside looking in --> inside looking around) on systems > that I ISSE and provision. I do not recall "required watches" that need to > be set with this tool, but I maybe off a version and I may need to visit > another sight to pick up the latest and greatest.... > > I know SECSCAN would like the System to be configured to HALT on audit > failure using the disk_ful_action_setting in /etc/audit/auditd.conf. It > would also like the system to be configured to halt on audit disk error as > well as the audit data to be synchronously flushed to disk to avoid data > loss. To do this (respectfully) I have set in my KickStarts and Satellite: > > perl -npe 's/disk_full_action = SUSPEND/disk_full_action = HALT/' -i > /etc/audit/auditd.conf > perl -npe 's/disk_error_action = SUSPEND/disk_error_action = HALT/' -i > /etc/audit/auditd.conf > perl -npe 's/flush = INCREMENTAL/flush = SYNC/' -i /etc/audit/auditd.conf > > Currently I set the /var/log/audit logs to rotate daily for 90 days... in > /etc/logrotate.d/audit and the capp.rules ; nispom.rules in > /usr/share/doc/audit* all work great and provide nice examples to comply > with Security Policy. > > Because of the logrotation and the way aureport works, I have written a > wrapper script to be able to search and report all the log files. Something > of this type would help the Security Officers look threw the log files. The > script also keeps a pristine copy of the log files for investigation with > digital sigs to watch the tampering (as well as aide) for investigation if > need be --> this keeps processing the files (MAC Times) and a pristine copy > separated. > > I am very interested in finding our more about these set watches that are > required in SECSCAN. > > Best regards, > > > Norman Mark St. Laurent > Conceras | Chief Technology Officer and ISSE > > > > David Flatley wrote: > >> >> Thanks Steve! >> If I were to move all the rotated logs to another directory, say >> /home/logs. So instead of doing "ausearch -i" to capture all the information >> in the rotated logs in >> /var/log/audit directory. I would do "ausearch -i -f /home/logs" , >> correct? >> >> Backlog is set to 12288 right now. >> >> The SECSCAN requires many -w (watches) and a fair amount of syscalls. I >> modified the syscalls to add your recommendation for using "arch=b32" and >> "arch=b64". >> Because I was getting errors restarting the auditd on some of their >> recommendations one of which was mount? >> >> Another setting I believe was doing me in was the log size is 20 megs and >> I allow 8 rotated logs. But I had admin_disk_full set to 160 and the action >> was suspend. >> So this could have been tripping me up also. >> >> I would like to be able to do the audit log extractions (ausearch and >> aureport) when I get say 8 - 20 megs logs. I see I can do an exec on a >> script in max_log_file_action. >> So if I set the max_log_file to 160, I can then run a script to move the >> rotated logs and process them, thus not stopping auditd and keeping things >> working? I would set the >> max rotated logs to 10 to allow the new rotated log space then move the >> logs as you suggest. >> >> Thanks. >> >> David Flatley CISSP >> >> >> >> >> Inactive hide details for Steve Grubb ---08/13/2009 02:29:34 PM---On >> Thursday 13 August 2009 10:56:50 am David Flatley wrote: > Steve Grubb >> ---08/13/2009 02:29:34 PM---On Thursday 13 August 2009 10:56:50 am David >> Flatley wrote: > Red Hat 5.3 running audit 1.7.7-6 >> >> >> From: >> Steve Grubb >> >> To: >> linux-audit@redhat.com >> >> Cc: >> David Flatley/Burlington/IBM@IBMUS >> >> Date: >> 08/13/2009 02:29 PM >> >> Subject: >> Re: buffer space >> >> >> >> >> On Thursday 13 August 2009 10:56:50 am David Flatley wrote: >> > Red Hat 5.3 running audit 1.7.7-6 >> > Rotating logs at 20 megs and allowing 8 logs >> > Rules have watches and syscalls from the SECSCAN recommendations, and >> have >> > added some of Steve Grubb's recommendations. >> >> I would be curious what the SECSCAN recommendations are. Never heard of >> it... >> >> >> > When we extract and archive the audit logs we get "Error receiving audit >> > netlink packet (No buffer space available) an "error sending signal info >> > request" >> > Our extract is: stop auditd then create a file and run ausearch -i > >> file >> > then run an aureport -i > file then once that is done we delete all the >> > logs and restart auditd. >> >> I think this is your problem. If you have audit rules loaded and stop >> auditd, >> then audit events are going to pile up in the queue waiting for auditd to >> download them. At some point the kernel will decide auditd doesn't exist >> and >> will dump all events to syslog. This probably is not what you want either. >> >> I would recommend calling "service auditd rotate" and then grab logs >> audit.log.1 -> audit.logs.7 and move them away to another directory for >> post processing the contents. >> >> You may also want to check you backlog size settings too. >> >> >> > If I run this manually it works fine but if I have it running it in a >> cron >> > we get Kernel panics, lockups and log data loss plus the buffer >> messages. >> >> Shouldn't really make a difference. >> >> -Steve >> >> >> ------------------------------------------------------------------------ >> >> -- >> Linux-audit mailing list >> Linux-audit@redhat.com >> https://www.redhat.com/mailman/listinfo/linux-audit >> > > -- > Linux-audit mailing list > Linux-audit@redhat.com > https://www.redhat.com/mailman/listinfo/linux-audit > --00235407f00653dd71047159511c Content-Type: text/html; charset=ISO-8859-1 Content-Transfer-Encoding: quoted-printable Attached are is the audit.rules file from SECSCN 4.3. =A0There is a v4.4 no= w available but I don't have it handy. =A0Also attached are two docs wh= ich explain SECSCN's auditd configuration expectations.=A0

= -Mike

On Mon, Aug 17, 2009 at 11:34 AM, Norma= n Mark St. Laurent <mstlaurent@conceras.com> wrote:
Hi David,

I too would like to know what version of SECSCAN you are using for the &quo= t;required watches". =A0I run the STIGS, SECSCAN, and a myriad of vuln= erability analysis tools (outside looking in --> =A0inside looking aroun= d) on systems that I ISSE and provision. =A0I do not recall "required = watches" that need to be set with this tool, but I maybe off a version= and I may need to visit another sight to pick up the latest and greatest..= ..

I know SECSCAN would like the System to be configured to HALT on audit fail= ure using the disk_ful_action_setting in /etc/audit/auditd.conf. =A0It woul= d also like the system to be configured to halt on audit disk error as well= as the audit data to be synchronously flushed to disk to avoid data loss. = =A0To do this (respectfully) I have set in my KickStarts and Satellite:

perl -npe 's/disk_full_action =3D SUSPEND/disk_full_action =3D HALT/= 9; -i /etc/audit/auditd.conf
perl -npe 's/disk_error_action =3D SUSPEND/disk_error_action =3D HALT/&= #39; -i /etc/audit/auditd.conf
perl -npe 's/flush =3D INCREMENTAL/flush =3D SYNC/' -i /etc/audit/a= uditd.conf

Currently I set the /var/log/audit logs to rotate daily for 90 days... =A0i= n /etc/logrotate.d/audit =A0and the capp.rules ; nispom.rules in /usr/share= /doc/audit* all work great and provide nice examples to comply with Securit= y Policy.

Because of the logrotation and the way aureport works, I have written a wra= pper script to be able to search and report all the log files. =A0Something= of this type would help the Security Officers look threw the log files. = =A0The script also keeps a pristine copy of the log files for investigation= with digital sigs to watch the tampering =A0(as well as aide) for investig= ation if need be --> this keeps processing the files (MAC Times) and a p= ristine copy separated.

I am very interested in finding our more about these set watches that are r= equired in SECSCAN.

Best regards,


Norman Mark St. Laurent
Conceras | Chief Technology Officer and ISSE



David Flatley wrote:

Thanks Steve!
If I were to move all the rotated logs to another directory, say /home/logs= . So instead of doing "ausearch -i" to capture all the informatio= n in the rotated logs in
/var/log/audit directory. I would do "ausearch -i -f /home/logs" = , correct?

Backlog is set to 12288 right now.

The SECSCAN requires many -w (watches) and a fair amount of syscalls. I mod= ified the syscalls to add your recommendation for using "arch=3Db32&qu= ot; and "arch=3Db64".
Because I was getting errors restarting the auditd on some of their recomme= ndations one of which was mount?

Another setting I believe was doing me in was the log size is 20 megs and I= allow 8 rotated logs. But I had admin_disk_full set to 160 and the action = was suspend.
So this could have been tripping me up also.

I would like to be able to do the audit log extractions (ausearch and aurep= ort) when I get say 8 - 20 megs logs. I see I can do an exec on a script in= max_log_file_action.
So if I set the max_log_file to 160, I can then run a script to move the ro= tated logs and process them, thus not stopping auditd and keeping things wo= rking? I would set the
max rotated logs to 10 to allow the new rotated log space then move the log= s as you suggest.

Thanks.

David Flatley CISSP




Inactive hide details for Steve Grubb ---08/13/2009 02:29:34 PM---On Thursd= ay 13 August 2009 10:56:50 am David Flatley wrote: > Steve Grubb ---08/1= 3/2009 02:29:34 PM---On Thursday 13 August 2009 10:56:50 am David Flatley w= rote: > Red Hat 5.3 running audit 1.7.7-6


From: =A0
Steve Grubb <sgru= bb@redhat.com>

To: =A0 =A0
linux-audit@red= hat.com

Cc: =A0 =A0
David Flatley/Burlington/IBM@IBMUS

Date: =A0
08/13/2009 02:29 PM

Subject: =A0 =A0 =A0 =A0
Re: buffer space




On Thursday 13 August 2009 10:56:50 am David Flatley wrote:
> =A0 Red Hat 5.3 running audit 1.7.7-6
> Rotating logs at 20 megs and allowing 8 logs
> Rules have watches and syscalls from the SECSCAN recommendations, and = have
> added some of Steve Grubb's recommendations.

I would be curious what the SECSCAN recommendations are. Never heard of it.= ..


> When we extract and archive the audit logs we get "Error receivin= g audit
> netlink packet (No buffer space available) an "error sending sign= al info
> request"
> Our extract is: stop auditd then create a file and run ausearch -i >= ; file
> then run an aureport -i > file then once that is done we delete all= the
> logs and restart auditd.

I think this is your problem. If you have audit rules loaded and stop audit= d,
then audit events are going to pile up in the queue waiting for auditd to download them. At some point the kernel will decide auditd doesn't exis= t and
will dump all events to syslog. This probably is not what you want either.<= br>
I would recommend calling "service auditd rotate" and then grab l= ogs
audit.log.1 -> audit.logs.7 and move them away to another directory for = post =A0processing the contents.

You may also want to check you backlog size settings too.


> If I run this manually it works fine but if I have it running it in a = cron
> we get Kernel panics, lockups and log data loss plus the buffer messag= es.

Shouldn't really make a difference.

-Steve


------------------------------------------------------------------------

--
Linux-audit mailing list
Linux-audit@red= hat.com
https://www.redhat.com/mailman/listinfo/linux-audit

--00235407f00653dd71047159511c-- --00235407f00653dd7a047159511e Content-Type: text/html; charset=US-ASCII; name="AUDIT1.HTML" Content-Disposition: attachment; filename="AUDIT1.HTML" Content-Transfer-Encoding: base64 X-Attachment-Id: f_fyhg9h8c1 PEhUTUw+CjxUSVRMRT5BdWRpdDE8L1RJVExFPgo8Qk9EWSBCR0NPTE9SPXdoaXRlPgoKPEgzPjxi PlByb3RlY3Rpb24gTGV2ZWwgMjwvYj48L0gzPgo8Yj5EQ0lEIDYvMyBSZXF1aXJlbWVudHMgLTwv Yj4KPEJSPjxCUj4KNC5CLjIuYSAgPGI+QSBzeXN0ZW0gb3BlcmF0aW5nIGF0IFByb3RlY3Rpb24g TGV2ZWwgMiBzaGFsbCBlbXBsb3kgdGhlIGZvbGxvd2luZyBmZWF0dXJlczo8L2I+CjxCUj48QlI+ CjQuQi4yLmEoNCkgPHU+W0F1ZGl0MV08L3U+IEF1ZGl0aW5nIHByb2NlZHVyZXMsIGluY2x1ZGlu ZzoKPEJSPjxCUj4KNC5CLjIuYSg0KShhKSBQcm92aWRpbmcgdGhlIGNhcGFiaWxpdHkgdG8gZW5z dXJlIHRoYXQgYWxsIGF1ZGl0IHJlY29yZHMgaW5jbHVkZSBlbm91Z2gKaW5mb3JtYXRpb24gdG8g YWxsb3cgdGhlIElTU08gdG8gZGV0ZXJtaW5lIHRoZSBkYXRlIGFuZCB0aW1lIG9mIGFjdGlvbiAo ZS5nLiwKY29tbW9uIG5ldHdvcmsgdGltZSksIHRoZSBzeXN0ZW0gbG9jYWxlIG9mIHRoZSBhY3Rp b24sIHRoZSBzeXN0ZW0gZW50aXR5IHRoYXQKaW5pdGlhdGVkIG9yIGNvbXBsZXRlZCB0aGUgYWN0 aW9uLCB0aGUgcmVzb3VyY2VzIGludm9sdmVkLCBhbmQgdGhlIGFjdGlvbgppbnZvbHZlZC4KPEJS PjxCUj4KNC5CLjIuYSg0KShiKSBQcm90ZWN0aW5nIHRoZSBjb250ZW50cyBvZiBhdWRpdCB0cmFp bHMgYWdhaW5zdCB1bmF1dGhvcml6ZWQgYWNjZXNzLAptb2RpZmljYXRpb24sIG9yIGRlbGV0aW9u Lgo8QlI+PEJSPgo0LkIuMi5hKDQpKGMpIE1haW50YWluaW5nIGNvbGxlY3RlZCBhdWRpdCBkYXRh IGF0IGxlYXN0IDUgeWVhcnMgYW5kIHJldmlld2luZyBhdCBsZWFzdAp3ZWVrbHkuCjxCUj48QlI+ CjQuQi4yLmEoNCkoZCkgVGhlIHN5c3RlbXMgY3JlYXRpbmcgYW5kIG1haW50YWluaW5nIGFuIGF1 ZGl0IHRyYWlsIHRoYXQgaW5jbHVkZXMgc2VsZWN0ZWQ8Yj4gPC9iPnJlY29yZHMKb2Y6IAo8QlI+ PEJSPgo0LkIuMi5hKDQpKGQpKDEpIFN1Y2Nlc3NmdWwgYW5kIHVuc3VjY2Vzc2Z1bCBsb2dvbnMg YW5kIGxvZ29mZnMuCjxCUj48QlI+CjQuQi4yLmEoNCkoZCkoMikgQWNjZXNzZXMgdG8gPGk+c2Vj dXJpdHktcmVsZXZhbnQ8L2k+IG9iamVjdHMgYW5kIGRpcmVjdG9yaWVzLCBpbmNsdWRpbmcgb3Bl bnMsCmNsb3NlcywgbW9kaWZpY2F0aW9ucywgYW5kIGRlbGV0aW9ucy4KPEJSPjxCUj4KNC5CLjIu YSg0KShkKSgzKSBBY3Rpdml0aWVzIGF0IHRoZSBzeXN0ZW0gY29uc29sZSAoZWl0aGVyIHBoeXNp Y2FsIG9yIGxvZ2ljYWwgY29uc29sZXMpLCBhbmQKb3RoZXIgc3lzdGVtLWxldmVsIGFjY2Vzc2Vz IGJ5IHByaXZpbGVnZWQgdXNlcnMuCjxCUj48QlI+CjxIUj4KCgo8Yj5KRENTSVNTUyA3LjUuMy4x IChVKSAoMSBKYW51YXJ5IDIwMDYgUmV2aXNpb24gNCkgQXV0b21hdGVkIEF1ZGl0IFRyYWlsIElu Zm9ybWF0aW9uIFJlcXVpcmVtZW50czwvYj4KPEJSPjxCUj4KSVNzIGFwcHJvdmVkIGZvciBjbGFz c2lmaWVkIHByb2Nlc3Npbmcgc2hvdWxkIGNvbnRhaW4sIGF0IGEgbWluaW11bSwgdGhlIGZvbGxv d2luZyBhdWRpdCB0cmFpbCByZWNvcmRzOgo8QlI+PEJSPgo8VEFCTEUgQk9SREVSPTEgV0lEVEg9 JzEwMCUnIENFTExQQURESU5HPTA+CjxUUj4KPFREIGFsaWduPW1pZGRsZSB2YWxpZ249bWlkZGxl Pk5vLjwvVEQ+CjxURCBhbGlnbj1taWRkbGUgdmFsaWduPW1pZGRsZT48Yj5BdWRpdGFibGUgRXZl bnRzPC9iPjwvVEQ+CjxURCBhbGlnbj1taWRkbGUgdmFsaWduPW1pZGRsZT48Yj5Qcm90ZWN0aW9u IExldmVsPC9iPjwvVEQ+CjxURCBhbGlnbj1taWRkbGUgdmFsaWduPW1pZGRsZT48Yj5TdWNjZXNz PC9iPjwvVEQ+CjxURCBhbGlnbj1taWRkbGUgdmFsaWduPW1pZGRsZT48Yj5GYWlsdXJlPC9iPjwv VEQ+CjxURCBhbGlnbj1taWRkbGUgdmFsaWduPW1pZGRsZT48Yj5SZWQgSGF0IExpbnV4IHN5c2Nh bGwgQXVkaXQgRmxhZyhzKTwvYj48L1REPgo8L1RSPgo8VFI+CjxURCBhbGlnbj1taWRkbGUgdmFs aWduPW1pZGRsZT4xPC9URD4KPFREIGFsaWduPWxlZnQgdmFsaWduPWxlZnQ+TG9nb25zPC9URD4K PFREIGFsaWduPW1pZGRsZSB2YWxpZ249bWlkZGxlPjEtNTwvVEQ+CjxURCBhbGlnbj1taWRkbGUg dmFsaWduPW1pZGRsZT5YPC9URD4KPFREIGFsaWduPW1pZGRsZSB2YWxpZ249bWlkZGxlPlg8L1RE Pgo8VEQgYWxpZ249bWlkZGxlIHZhbGlnbj1taWRkbGU+QXVkaXQgRGVmYXVsdDwvVEQ+CjwvVFI+ CjxUUj4KPFREIGFsaWduPW1pZGRsZSB2YWxpZ249bWlkZGxlPjI8L1REPgo8VEQgYWxpZ249bGVm dCB2YWxpZ249bGVmdD5Mb2dvZmZzPC9URD4KPFREIGFsaWduPW1pZGRsZSB2YWxpZ249bWlkZGxl PjEtNTwvVEQ+CjxURCBhbGlnbj1taWRkbGUgdmFsaWduPW1pZGRsZT4mbmJzcDs8L1REPgo8VEQg YWxpZ249bWlkZGxlIHZhbGlnbj1taWRkbGU+WDwvVEQ+CjxURCBhbGlnbj1taWRkbGUgdmFsaWdu PW1pZGRsZT5BdWRpdCBEZWZhdWx0PC9URD4KPC9UUj4KPFRSPgo8VEQgYWxpZ249bWlkZGxlIHZh bGlnbj1taWRkbGU+MzwvVEQ+CjxURCBhbGlnbj1sZWZ0IHZhbGlnbj1sZWZ0PlNlY3VyaXR5IHJl bGV2YW50IGRpcmVjdG9yaWVzLCBvYmplY3RzLCBhbmQgaW5jaWRlbnRzIChEQUMpPC9URD4KPFRE IGFsaWduPW1pZGRsZSB2YWxpZ249bWlkZGxlPjEtNTwvVEQ+CjxURCBhbGlnbj1taWRkbGUgdmFs aWduPW1pZGRsZT5YPC9URD4KPFREIGFsaWduPW1pZGRsZSB2YWxpZ249bWlkZGxlPlg8L1REPgo8 VEQgYWxpZ249bWlkZGxlIHZhbGlnbj1taWRkbGU+b3BlbiwgY3JlYXQgPC9URD4KPC9UUj4KPFRS Pgo8VEQgYWxpZ249bWlkZGxlIHZhbGlnbj1taWRkbGU+NDwvVEQ+CjxURCBhbGlnbj1sZWZ0IHZh bGlnbj1sZWZ0PlN5c3RlbSBDb25zb2xlIGFjdGl2aXRpZXM8L1REPgo8VEQgYWxpZ249bWlkZGxl IHZhbGlnbj1taWRkbGU+MS01PC9URD4KPFREIGFsaWduPW1pZGRsZSB2YWxpZ249bWlkZGxlPiZu YnNwOzwvVEQ+CjxURCBhbGlnbj1taWRkbGUgdmFsaWduPW1pZGRsZT5YPC9URD4KPFREIGFsaWdu PW1pZGRsZSB2YWxpZ249bWlkZGxlPmNobW9kLCBmY2htb2QsIGNob3duLCBjaG93bjMyLCBmY2hv d24sIGZjaG93bjMyLCBsY2hvd24sIGxjaG93bjMyLCBjcmVhdCwgb3BlbiwgdHJ1bmNhdGUsIHRy dW5jYXRlNjQsIGZ0cnVuY2F0ZSwgZnRydW5jYXRlNjQsIHVsaW5rLCByZW5hbWUsIGxpbmssIHN5 bWxpbmssIG1rbm9kLCBtb3VudCwgdW1vdW50LCB1bW91bnQyLCBjbG9uZSwgZm9yaywgdmZvcmss IHVtYXNrLCBhZGp0aW1leCwgc2V0dGltZW9mZGF5PC9URD4KPC9UUj4KPFRSPgo8VEQgYWxpZ249 bWlkZGxlIHZhbGlnbj1taWRkbGU+NTwvVEQ+CjxURCBhbGlnbj1sZWZ0IHZhbGlnbj1sZWZ0PlVz ZSBvZiBQcml2aWxlZ2VkL1NwZWNpYWwgUmlnaHRzPC9URD4KPFREIGFsaWduPW1pZGRsZSB2YWxp Z249bWlkZGxlPjEtNTwvVEQ+CjxURCBhbGlnbj1taWRkbGUgdmFsaWduPW1pZGRsZT4mbmJzcDs8 L1REPgo8VEQgYWxpZ249bWlkZGxlIHZhbGlnbj1taWRkbGU+WDwvVEQ+CjxURCBhbGlnbj1taWRk bGUgdmFsaWduPW1pZGRsZT5jaG1vZCwgZmNobW9kLCBjaG93biwgY2hvd24zMiwgZmNob3duLCBm Y2hvd24zMiwgbGNob3duLCBsY2hvd24zMiwgY3JlYXQsIG9wZW4sIHRydW5jYXRlLCB0cnVuY2F0 ZTY0LCBmdHJ1bmNhdGUsIGZ0cnVuY2F0ZTY0LCB1bGluaywgcmVuYW1lLCBsaW5rLCBzeW1saW5r LCBta25vZCwgbW91bnQsIHVtb3VudCwgdW1vdW50MjwvVEQ+CjwvVFI+CjxUUj4KPFREIGFsaWdu PW1pZGRsZSB2YWxpZ249bWlkZGxlPjY8L1REPgo8VEQgYWxpZ249bGVmdCB2YWxpZ249bGVmdD5S b290IExldmVsIEFjY2VzczwvVEQ+CjxURCBhbGlnbj1taWRkbGUgdmFsaWduPW1pZGRsZT4xLTU8 L1REPgo8VEQgYWxpZ249bWlkZGxlIHZhbGlnbj1taWRkbGU+WDwvVEQ+CjxURCBhbGlnbj1taWRk bGUgdmFsaWduPW1pZGRsZT5YPC9URD4KPFREIGFsaWduPW1pZGRsZSB2YWxpZ249bWlkZGxlPmNo b3duLCBjaG93bjMyLCBmY2hvd24sIGZjaG93bjMyLCBsY2hvd24sIGxjaG93bjMyLCBhZGp0aW1l eCwgc2V0dGltZW9mZGF5PC9URD4KPC9UUj4KPFRSPgo8VEQgYWxpZ249bWlkZGxlIHZhbGlnbj1t aWRkbGU+NzwvVEQ+CjxURCBhbGlnbj1sZWZ0IHZhbGlnbj1sZWZ0PlVwbG9hZHMgZnJvbSBsb2Nh bCBkZXZpY2VzPC9URD4KPFREIGFsaWduPW1pZGRsZSB2YWxpZ249bWlkZGxlPjEtNTwvVEQ+CjxU RCBhbGlnbj1taWRkbGUgdmFsaWduPW1pZGRsZT5YPC9URD4KPFREIGFsaWduPW1pZGRsZSB2YWxp Z249bWlkZGxlPlg8L1REPgo8VEQgYWxpZ249bWlkZGxlIHZhbGlnbj1taWRkbGU+bW91bnQsIHVt b3VudCwgdW1vdW50MjwvVEQ+CjwvVFI+CjxUUj4KPFREIGFsaWduPW1pZGRsZSB2YWxpZ249bWlk ZGxlPjg8L1REPgo8VEQgYWxpZ249bGVmdCB2YWxpZ249bGVmdD5Xcml0ZXMvRG93bmxvYWRzIHRv IGxvY2FsIGRldmljZXMoQSBkcml2ZXMsIEphenogZHJpdmVzLCBQcmludGVycyk8L1REPgo8VEQg YWxpZ249bWlkZGxlIHZhbGlnbj1taWRkbGU+MS01PC9URD4KPFREIGFsaWduPW1pZGRsZSB2YWxp Z249bWlkZGxlPlg8L1REPgo8VEQgYWxpZ249bWlkZGxlIHZhbGlnbj1taWRkbGU+Jm5ic3A7PC9U RD4KPFREIGFsaWduPW1pZGRsZSB2YWxpZ249bWlkZGxlPm1vdW50LCB1bW91bnQsIHVtb3VudDI8 L1REPgo8L1RSPgo8VFI+CjxURCBhbGlnbj1taWRkbGUgdmFsaWduPW1pZGRsZT45PC9URD4KPFRE IGFsaWduPWxlZnQgdmFsaWduPWxlZnQ+U3lzdGVtIFJlc3RhcnRzL1NodXRkb3duczwvVEQ+CjxU RCBhbGlnbj1taWRkbGUgdmFsaWduPW1pZGRsZT4xLTU8L1REPgo8VEQgYWxpZ249bWlkZGxlIHZh bGlnbj1taWRkbGU+WDwvVEQ+CjxURCBhbGlnbj1taWRkbGUgdmFsaWduPW1pZGRsZT5YPC9URD4K PFREIGFsaWduPW1pZGRsZSB2YWxpZ249bWlkZGxlPnJlYm9vdDwvVEQ+CjwvVFI+CjxUUj4KPFRE IGFsaWduPW1pZGRsZSB2YWxpZ249bWlkZGxlPjEwPC9URD4KPFREIGFsaWduPWxlZnQgdmFsaWdu PWxlZnQ+Q2hhbmdlIG9mIHVzZXJzIGZvcm1hbCBhY2Nlc3MgcGVybWlzc2lvbnM8L1REPgo8VEQg YWxpZ249bWlkZGxlIHZhbGlnbj1taWRkbGU+My01PC9URD4KPFREIGFsaWduPW1pZGRsZSB2YWxp Z249bWlkZGxlPlg8L1REPgo8VEQgYWxpZ249bWlkZGxlIHZhbGlnbj1taWRkbGU+WDwvVEQ+CjxU RCBhbGlnbj1taWRkbGUgdmFsaWduPW1pZGRsZT5OL0E8L1REPgo8L1RSPgo8VFI+CjxURCBhbGln bj1taWRkbGUgdmFsaWduPW1pZGRsZT4xMTwvVEQ+CjxURCBhbGlnbj1sZWZ0IHZhbGlnbj1sZWZ0 PkluZm9ybWF0aW9uIGRvd25ncmFkZXMgYW5kIG92ZXJyaWRlczwvVEQ+CjxURCBhbGlnbj1taWRk bGUgdmFsaWduPW1pZGRsZT40LTU8L1REPgo8VEQgYWxpZ249bWlkZGxlIHZhbGlnbj1taWRkbGU+ WDwvVEQ+CjxURCBhbGlnbj1taWRkbGUgdmFsaWduPW1pZGRsZT5YPC9URD4KPFREIGFsaWduPW1p ZGRsZSB2YWxpZ249bWlkZGxlPk4vQTwvVEQ+CjwvVFI+CjxUUj4KPFREIGFsaWduPW1pZGRsZSB2 YWxpZ249bWlkZGxlPjEyPC9URD4KPFREIGFsaWduPWxlZnQgdmFsaWduPWxlZnQ+QXR0ZW1wdGVk IGFjY2VzcyB0byBvYmplY3RzIG9yIGRhdGEgd2hvc2UgbGFiZWxzIGFyZSBpbmNvbnNpc3RlbnQg d2l0aCB1c2VyIHByaXZpbGVnZXM8L1REPgo8VEQgYWxpZ249bWlkZGxlIHZhbGlnbj1taWRkbGU+ NC01PC9URD4KPFREIGFsaWduPW1pZGRsZSB2YWxpZ249bWlkZGxlPiZuYnNwOzwvVEQ+CjxURCBh bGlnbj1taWRkbGUgdmFsaWduPW1pZGRsZT5YPC9URD4KPFREIGFsaWduPW1pZGRsZSB2YWxpZ249 bWlkZGxlPk4vQTwvVEQ+CjwvVFI+CjxUUj4KPFREIGFsaWduPW1pZGRsZSB2YWxpZ249bWlkZGxl PjEzPC9URD4KPFREIGFsaWduPWxlZnQgdmFsaWduPWxlZnQ+Q2hhbmdlcyB0byBzZWN1cml0eSBs YWJlbHM8L1REPgo8VEQgYWxpZ249bWlkZGxlIHZhbGlnbj1taWRkbGU+NC01PC9URD4KPFREIGFs aWduPW1pZGRsZSB2YWxpZ249bWlkZGxlPlg8L1REPgo8VEQgYWxpZ249bWlkZGxlIHZhbGlnbj1t aWRkbGU+WDwvVEQ+CjxURCBhbGlnbj1taWRkbGUgdmFsaWduPW1pZGRsZT5jaG1vZCwgZmNobW9k LCBjaG93biwgY2hvd24zMiwgZmNob3duLCBmY2hvd24zMiwgbGNob3duLCBsY2hvd24zMiwgdW1h c2s8L1REPgo8L1RSPgo8L1RBQkxFPgoKPGNlbnRlcj4KPGEgaHJlZj0iamF2YXNjcmlwdDp3aW5k b3cuY2xvc2UoKSI+Q2xvc2U8L2E+CjwvY2VudGVyPgoKPC9CT0RZPgo8L0hUTUw+Cg== --00235407f00653dd7a047159511e Content-Type: application/octet-stream; name="AUDIT.RULES" Content-Disposition: attachment; filename="AUDIT.RULES" Content-Transfer-Encoding: base64 X-Attachment-Id: f_fyhg73w60 IyMKIyMgVGhpcyBmaWxlIGNvbnRhaW5zIGEgc2FtcGxlIGF1ZGl0IGNvbmZpZ3VyYXRpb24uICBU aGUgcnVsZXMgY2FuIGJlCiMjIGNvcGllZCBhbmQgcGFzdGVkIGludG8geW91ciBhdWRpdC5ydWxl cyBmaWxlIHVzdWFsbHkgbG9jYXRlZCBpbiB0aGUKIyMgL2V0Yy9hdWRpdC8gZGlyZWN0b3J5LiAK IyMgTm90ZTogQWxsIHNldHRpbmdzIHNob3VsZCBiZSB0ZXN0ZWQgb24gYSBub24tcHJvZHVjdGlv biBzeXN0ZW0gcHJpb3IKIyMgdG8gaW1wbGVtZW50YXRpb24gb24gYW55IHByb2R1Y3Rpb24gc3lz dGVtLgoKIyMgUmVtb3ZlIGFueSBleGlzdGluZyBydWxlcwotRAoKIyMgSW5jcmVhc2UgYnVmZmVy IHNpemUgdG8gaGFuZGxlIHRoZSBpbmNyZWFzZWQgbnVtYmVyIG9mIG1lc3NhZ2VzLgojIyBGZWVs IGZyZWUgdG8gaW5jcmVhc2UgdGhpcyBpZiB0aGUgbWFjaGluZSBwYW5pYydzCi1iIDgxOTIKCiMj IFNldCBmYWlsdXJlIG1vZGUgdG8gcGFuaWMKLWYgMgoKIyMgT3BlcmF0aW9ucyBvbiBmaWxlIHN5 c3RlbSBvYmplY3RzIC0gYnkgZGVmYXVsdCwgb25seSBtb25pdG9yCiMjIGZpbGVzIGFuZCBkaXJl Y3RvcmllcyBjb3ZlcmVkIGJ5IGZpbGVzeXN0ZW0gd2F0Y2hlcy4KCiMjIENoYW5nZXMgaW4gb3du ZXJzaGlwIGFuZCBwZXJtaXNzaW9ucwotYSBlbnRyeSxhbHdheXMgLVMgY2htb2QgLVMgZmNobW9k IC1TIGNob3duIC1TIGZjaG93biAtUyBsY2hvd24KIyMgRW5hYmxlICozMiBydWxlcyBpZiB5b3Ug YXJlIHJ1bm5pbmcgb24gaTM4NiBvciBzMzkwCiMjIERvIG5vdCB1c2UgZm9yIHg4Nl82NCwgaWE2 NCwgcHBjLCBwcGM2NCwgb3IgczM5MHgKIy1hIGVudHJ5LGFsd2F5cyAtUyBmY2hvd24zMgojLWEg ZW50cnksYWx3YXlzIC1TIGNob3duMzIKIy1hIGVudHJ5LGFsd2F5cyAtUyBsY2hvd24zMgoKIyMg RmlsZSBjb250ZW50IG1vZGlmaWNhdGlvbi4gUGVybWlzc2lvbnMgYXJlIGNoZWNrZWQgYXQgb3Bl biB0aW1lLAojIyBtb25pdG9yaW5nIGluZGl2aWR1YWwgcmVhZC93cml0ZSBjYWxscyBpcyBub3Qg dXNlZnVsLgojLWEgZW50cnksYWx3YXlzIC1TIGNyZWF0IC1TIG9wZW4gLVMgdHJ1bmNhdGUgLVMg ZnRydW5jYXRlCiMjIEVuYWJsZSAqNjQgcnVsZXMgaWYgeW91IGFyZSBydW5uaW5nIG9uIGkzODYs IHBwYywgcHBjNjQsIHMzOTAKIyMgRG8gbm90IHVzZSBmb3IgeDg2XzY0LCBpYTY0LCBvciBzMzkw eAojLWEgZW50cnksYWx3YXlzIC1TIHRydW5jYXRlNjQKIy1hIGVudHJ5LGFsd2F5cyAtUyBmdHJ1 bmNhdGU2NAoKIyNVbmF1dGhvcml6ZWQgYWNjZXNzIGF0dGVtcHRzIHRvIGZpbGVzICh1bnN1Y2Nl c3NmdWwpLiBVc2UgYjY0IGZvciA2NCBiaXQgYXJjaGl0ZWN0dXJlCi1hIGV4aXQsYWx3YXlzIGFy Y2g9YjMyIC1TIGNyZWF0IC1TIG9wZW4gLVMgdHJ1bmNhdGUgLVMgZnRydW5jYXRlIC1GIGV4aXQ9 LUVBQ0NFUyAtRiBleGl0PS1FUEVSTSAtRiBhdWlkPj01MDAgLUYgYXVpZCE9NDI5NDk2NzI5NSAt ayBhY2Nlc3MKCiMtYSBleGl0LGFsd2F5cyBhcmNoPWI2NCAtUyBjcmVhdCAtUyBvcGVuIC1TIHRy dW5jYXRlIC1TIGZ0cnVuY2F0ZSAtRiBleGl0PS1FQUNDRVMgLUYgZXhpdD0tRVBFUk0gLUYgYXVp ZD49NTAwIC1GIGF1aWQhPTQyOTQ5NjcyOTUgLWsgYWNjZXNzCgoKIyMgZGlyZWN0b3J5IG9wZXJh dGlvbnMKLWEgZW50cnksYWx3YXlzIC1TIG1rZGlyIC1TIHJtZGlyCgojIyBtb3ZpbmcsIHJlbW92 aW5nLCBhbmQgbGlua2luZwotYSBlbnRyeSxhbHdheXMgLVMgdW5saW5rIC1TIHJlbmFtZSAtUyBs aW5rIC1TIHN5bWxpbmsKCiMjIHNwZWNpYWwgZmlsZXMKLWEgZW50cnksYWx3YXlzIC1TIG1rbm9k CgojIyBPdGhlciBmaWxlIHN5c3RlbSBvcGVyYXRpb25zCi1hIGVudHJ5LGFsd2F5cyAtUyBtb3Vu dAojIyBFbmFibGUgdW1vdW50IHJ1bGUgaWYgeW91IGFyZSBydW5uaW5nIG9uIGkzODYscHBjLHBw YzY0LHMzOTAsczM5MHgsaWE2NAojIyBEbyBub3QgdXNlIGZvciB4ODZfNjQKLWEgZW50cnksYWx3 YXlzIC1TIHVtb3VudAojIyBFbmFibGUgdW1vdW50IHJ1bGUgaWYgeW91IGFyZSBydW5uaW5nIG9u IGkzODYscHBjLHBwYzY0LHMzOTAsczM5MHgsaWE2NAojIyBEbyBub3QgdXNlIGZvciBpYTY0CiMt YSBlbnRyeSxhbHdheXMgLVMgdW1vdW50MgoKIyMgc3VjY2VzcyBhbmQgZmFpbHVyZSBvZiBiaW5k aW5nIHVzZXIgc2VjdXJpdHkgYXR0cmlidXRlcyB0byBhIHN1YmplY3QKIyMKIyMgRW5hYmxlIGlm IHlvdSBhcmUgaW50ZXJlc3RlZCBpbiB0aGVzZSBldmVudHMKIyMKLWEgZW50cnksYWx3YXlzIC1T IGNsb25lCi1hIGVudHJ5LGFsd2F5cyAtUyBmb3JrCi1hIGVudHJ5LGFsd2F5cyAtUyB2Zm9yawoj IyBGb3IgaWE2NCBhcmNoaXRlY3R1cmUsIGRpc2FibGUgZm9yayBhbmQgdmZvcmsgcnVsZXMgYWJv dmUsIGFuZAojIyBlbmFibGUgdGhlIGZvbGxvd2luZzoKIy1hIGVudHJ5LGFsd2F5cyAtUyBjbG9u ZTIKCiMjCiMjIG1vZGlmaWNhdGlvbnMgb2YgdGhlIGRlZmF1bHQgc2V0dGluZyBvZiBwZXJtaXNz aXZlIG9yIHJlc3RyaWN0aXZlCiMjIHJ1bGVzLCBhbGwgbW9kaWZpY2F0aW9ucyBvZiB0aGUgaW5p dGlhbCB2YWx1ZSBvZiBzZWN1cml0eSBhdHRyaWJ1dGVzCiMjCiMjIEVuYWJsZSBpZiB5b3UgYXJl IGludGVyZXN0ZWQgaW4gdGhlc2UgZXZlbnRzCiMjCi1hIGVudHJ5LGFsd2F5cyAtUyB1bWFzawoK IyMKIyMgY2hhbmdlcyB0byB0aGUgdGltZQojIwotYSBlbnRyeSxhbHdheXMgLVMgYWRqdGltZXgg LVMgc2V0dGltZW9mZGF5CgojI1JlY29tbWVuZGVkIEZpbGUgU3lzdGVtIHdhdGNoZXMuIFBsZWFz ZSBhZGQgYW55IG90aGVyIHNlbnNpdGl2ZSBmaWxlcyBhbmQgCiMjZGlyZWN0b3JpZXMgdG8gdGhp cyBsaXN0LgoKIyMKIyMgc3VjY2Vzc2Z1bCBhbmQgdW5zdWNjZXNzZnVsIGF0dGVtcHRzIHRvIHJl YWQgaW5mb3JtYXRpb24gZnJvbSB0aGUKIyMgYXVkaXQgcmVjb3JkczsgYWxsIG1vZGlmaWNhdGlv bnMgdG8gdGhlIGF1ZGl0IHRyYWlsCiMjCi13IC92YXIvbG9nL2F1ZGl0LyAtayBMT0dfYXVkaXQK LXcgL3Zhci9sb2cvYXVkaXQvYXVkaXRfbG9nIC1rIExPR19hdWRpdF9sb2cKLXcgL3Zhci9sb2cv YXVkaXQvYXVkaXRfbG9nLjEgLWsgTE9HX2F1ZGl0X2xvZwotdyAvdmFyL2xvZy9hdWRpdC9hdWRp dF9sb2cuMiAtayBMT0dfYXVkaXRfbG9nCi13IC92YXIvbG9nL2F1ZGl0L2F1ZGl0X2xvZy4zIC1r IExPR19hdWRpdF9sb2cKLXcgL3Zhci9sb2cvYXVkaXQvYXVkaXRfbG9nLjQgLWsgTE9HX2F1ZGl0 X2xvZwoKIyMgCiMjIG1vZGlmaWNhdGlvbnMgdG8gYXVkaXQgY29uZmlndXJhdGlvbiB0aGF0IG9j Y3VyIHdoaWxlIHRoZSBhdWRpdAojIyBjb2xsZWN0aW9uIGZ1bmN0aW9ucyBhcmUgb3BlcmF0aW5n OyBhbGwgbW9kaWNhdGlvbnMgdG8gdGhlIHNldCBvZgojIyBhdWRpdGVkIGV2ZW50cwojIwotdyAv ZXRjL2F1ZGl0L2F1ZGl0ZC5jb25mIC1rIENGR19hdWRpdGQuY29uZgotdyAvZXRjL2F1ZGl0L2F1 ZGl0LnJ1bGVzIC1rIENGR19hdWRpdC5ydWxlcwotdyAvZXRjL2xpYmF1ZGl0LmNvbmYgLXAgd2Eg LWsgQ0ZHX2xpYmF1ZGl0LmNvbmYKCi13IC9ldGMvbnRwLmNvbmYKLXcgL2V0YwotdyAvdmFyL3Nw b29sL2F0Ci13IC9ldGMvYXQuYWxsb3cKLXcgL2V0Yy9hdC5kZW55Ci13IC9ldGMvY3Jvbi5hbGxv dwotdyAvZXRjL2Nyb24uZGVueQotdyAvZXRjL2Nyb24uZC8KLXcgL2V0Yy9jcm9uLmRhaWx5Lwot dyAvZXRjL2Nyb24uaG91cmx5LwotdyAvZXRjL2Nyb24ubW9udGhseS8KLXcgL2V0Yy9jcm9uLndl ZWtseS8KLXcgL2V0Yy9jcm9udGFiCi13IC92YXIvc3Bvb2wvY3Jvbi9yb290Ci13IC9ldGMvYW5h Y3JvbnRhYgotdyAvZXRjL2dyb3VwCi13IC9ldGMvcGFzc3dkCi13IC9ldGMvZ3NoYWRvdwotdyAv ZXRjL3NoYWRvdwotdyAvZXRjL3NoYWRvdy5PTEQKLXcgL2V0Yy9zZWN1cml0eS9vcGFzc3dkCi13 IC9ldGMvc3Vkb2VycwotdyAvZXRjL2xvZ2luLmRlZnMKLXcgL2V0Yy9zZWN1cmV0dHkKLXcgL3Zh ci9sb2cvZmFpbGxvZwotdyAvdmFyL2xvZy9sYXN0bG9nCi13IC9ldGMvc2hlbGxzCi13IC9ldGMv cHJvZmlsZQotdyAvZXRjL2Jhc2hyYwotdyAvZXRjL2NzaC5jc2hyYwotdyAvZXRjL2NzaC5sb2dp bgotdyAvZXRjL2hvc3RzCi13IC9ldGMvc3lzY29uZmlnLwotdyAvZXRjL2RoY3BkLmNvbmYKLXcg L2V0Yy9kaGNsaWVudC1ldGgwLmNvbmYKLXcgL2V0Yy9pbml0dGFiCi13IC9ldGMvcmMuZC9pbml0 LmQvCi13IC9ldGMvcmMuZC9pbml0LmQvYXVkaXRkCi13IC9ldGMvcmMubG9jYWwKLXcgL2V0Yy9y Yy5zeXNpbml0Ci13IC9ldGMveGluZXRkLmNvbmYKLXcgL2V0Yy94aW5ldGQuZC8KLXcgL2V0Yy9s ZC5zby5jb25mCi13IC9ldGMvbGQuc28uY29uZi5kLwotdyAvZXRjL2xvY2FsdGltZQotdyAvZXRj L3N5c2N0bC5jb25mCi13IC9ldGMvbW9kcHJvYmUuY29uZgotdyAvZXRjL3BhbS5kCi13IC9ldGMv cGFtX3NtYi5jb25mCi13IC9ldGMvYWxpYXNlcwotdyAvZXRjL3Bvc3RmaXgvCi13IC9ldGMvbWFp bC9hY2Nlc3MKLXcgL2V0Yy9tYWlsL2FjY2Vzcy5kYgotdyAvZXRjL21haWwvYWxpYXNlcwotdyAv ZXRjL21haWwvZG9tYWludGFibGUKLXcgL2V0Yy9tYWlsL2RvbWFpbnRhYmxlLmRiCi13IC9ldGMv bWFpbC9oZWxwZmlsZQotdyAvZXRjL21haWwvbG9jYWwtaG9zdC1uYW1lcwotdyAvZXRjL21haWwv bWFpbGVydGFibGUKLXcgL2V0Yy9tYWlsL21haWxlcnRhYmxlLmRiCi13IC9ldGMvbWFpbC9NYWtl ZmlsZQotdyAvZXRjL21haWwvc2VuZG1haWwuY2YKLXcgL2V0Yy9tYWlsL3NlbmRtYWlsLm1jCi13 IC9ldGMvbWFpbC9zdWJtaXQuY2YKLXcgL2V0Yy9tYWlsL3N1Ym1pdC5tYwotdyAvZXRjL21haWwv dHJ1c3RlZC11c2VycwotdyAvZXRjL21haWwvdmlydHVzZXJ0YWJsZQotdyAvZXRjL21haWwvdmly dHVzZXJ0YWJsZS5kYgotdyAvZXRjL3NzaC9zc2hkX2NvbmZpZwotdyAvZXRjL3N0dW5uZWwvc3R1 bm5lbC5jb25mCi13IC9ldGMvc3R1bm5lbC9zdHVubmVsLnBlbQotdyAvZXRjL3ZzZnRwZC5mdHB1 c2VycwotdyAvZXRjL3ZzZnRwZC92c2Z0cGQuY29uZgotdyAvZXRjL2h0dHBkL2NvbmYvCi13IC9l dGMvaHR0cGQvY29uZi5kLwotdyAvZXRjL2lzc3VlCi13IC9ldGMvaXNzdWUubmV0Ci13IC9ldGMv c2FtYmEvc21iLmNvbmYKLXcgL2V0Yy9zYW1iYS9zbWJwYXNzd2QKLXcgL2V0Yy9zYW1iYS9zZWNy ZXRzLnRkYgotdyAvZXRjL215LmNvbmYKLXcgL2V0Yy9zeXNsb2cuY29uZgotdyAvZXRjL3NubXAv c25tcGQuY29uZgotdyAvZXRjL3Jlc29sdi5jb25mCi13IC9ldGMvbnNzd2l0Y2guY29uZgotdyAv ZXRjL2hvc3QuY29uZgotdyAvZXRjL3lwLmNvbmYKLXcgL3Zhci95cC9iaW5kaW5nCi13IC9ldGMv bGRhcC5jb25mCi13IC9ldGMva3JiNS5jb25mCi13IC9ldGMva3JiLmNvbmYKLXcgL2V0Yy9rcmIu cmVhbG1zCi13IC9ldGMvaW5pdGxvZy5jb25mCi13IC9ldGMvZGVmYXVsdC8KLXcgL2V0Yy9maXJt d2FyZS9taWNyb2NvZGUuZGF0Ci13IC9ldGMvZnN0YWIKLXcgL2V0Yy9hdXRvLm1hc3RlcgotdyAv ZXRjL2F1dG8ubWlzYwotdyAvZXRjL2hvc3RzLmFsbG93Ci13IC9ldGMvaG9zdHMuZGVueQotdyAv ZXRjL2V4cG9ydHMK --00235407f00653dd7a047159511e Content-Type: text/html; charset=US-ASCII; name="AUDITDESCRIP.HTML" Content-Disposition: attachment; filename="AUDITDESCRIP.HTML" Content-Transfer-Encoding: base64 X-Attachment-Id: f_fyhg9kdb2 PEhUTUw+DQo8VElUTEU+QXVkaXQgUnVsZXMgRGVzY3JpcHRpb25zPC9USVRMRT4NCjxCT0RZIEJH Q09MT1I9d2hpdGU+DQo8YnI+PGNlbnRlcj48aDE+UmVkIEhhdCBTeXNjYWxsIEF1ZGl0aW5nIERl c2NyaXB0aW9uczwvaDE+PC9jZW50ZXI+PGhyPg0KDQo8VEFCTEUgQk9SREVSPTEgV0lEVEg9JzEw MCUnIENFTExQQURESU5HPTA+DQo8VFI+DQo8VEQgYWxpZ249bWlkZGxlIHZhbGlnbj1taWRkbGU+ PGI+U3lzY2FsbCBOYW1lPC9iPjwvVEQ+DQo8VEQgYWxpZ249bWlkZGxlIHZhbGlnbj1taWRkbGU+ PGI+UnVsZTwvYj48L1REPg0KPFREIGFsaWduPW1pZGRsZSB2YWxpZ249bWlkZGxlPjxiPkRlc2Ny aXB0aW9uPC9iPjwvVEQ+DQo8VEQgYWxpZ249bWlkZGxlIHZhbGlnbj1taWRkbGU+PGI+QXVkaXQg SW1wbGljYXRpb248L2I+PC9URD4NCjxURCBhbGlnbj1taWRkbGUgdmFsaWduPW1pZGRsZT48Yj5S ZWNvbW1lbmRhdGlvbiBmb3IgVGFjdGljYWwgU3lzdGVtPC9iPjwvVEQ+DQo8VEQgYWxpZ249bWlk ZGxlIHZhbGlnbj1taWRkbGU+PGI+PC9iPjwvVEQ+DQo8L1RSPg0KPFRSPg0KPFREIGFsaWduPWxl ZnQgdmFsaWduPXRvcD48Yj5jaG1vZCA8YnI+ZmNobW9kPC9iPjwvVEQ+DQo8VEQgYWxpZ249bGVm dCB2YWxpZ249dG9wPi1hIGVudHJ5LGFsd2F5cyAtUyBjaG1vZCAtUyBmY2htb2Q8L1REPg0KPFRE IGFsaWduPWxlZnQgdmFsaWduPXRvcD5jaG1vZCBjaGFuZ2VzIHRoZSBwZXJtaXNzaW9ucyBvZiBl YWNoIGdpdmVuIGZpbGUgYWNjb3JkaW5nIHRvIG1vZGUsIHdoaWNoIGNhbiBiZSBlaXRoZXIgYSBz eW1ib2xpYyByZXByZXNlbnRhdGlvbiBvZiBjaGFuZ2VzIHRvIG1ha2Ugb3IgYW4gb2N0YWwgbnVt YmVyIHJlcHJlc2VudGluZyB0aGUgYml0IHBhdHRlcm4gZm9yIHRoZSBuZXcgcGVybWlzc2lvbjwv VEQ+DQo8VEQgYWxpZ249bGVmdCB2YWxpZ249dG9wPm1vbml0b3JzIGNoYW5nZXMgdG8gZmlsZSBw ZXJtaXNzaW9uczwvVEQ+DQo8VEQgYWxpZ249bWlkZGxlIHZhbGlnbj10b3A+QXVkaXQgYWxsPC9U RD4NCjwvVFI+DQo8VFI+DQo8VEQgYWxpZ249bGVmdCB2YWxpZ249dG9wPjxiPmNob3duIDxicj5j aG93bjMyIDxicj5mY2hvd24gPGJyPmZjaG93bjMyIDxicj5sY2hvd24gPGJyPmxjaG9udzMyPC9i PjwvVEQ+DQo8VEQgYWxpZ249bGVmdCB2YWxpZ249dG9wPi1hIGVudHJ5LGFsd2F5cyAtUyBjaG93 biAtUyBjaG93bjMyIC1TIGZjaG93biAtUyBmY2hvd24zMiAtUyBsY2hvd24gLVMgbGNob3duMzI8 L1REPg0KPFREIGFsaWduPWxlZnQgdmFsaWduPXRvcD5jaG93biBjaGFuZ2VzIHRoZSB1c2VyIGFu ZC9vciBncm91cCBvd25lcnNoaXAgb2YgZWFjaCBnaXZlbiBmaWxlPC9URD4NCjxURCBhbGlnbj1s ZWZ0IHZhbGlnbj10b3A+bW9uaXRvcnMgY2hhbmdlcyB0byBmaWxlIG93bmVyc2hpcDxicj48Yj5O b3RlOjwvYj4gRW5hYmxlICozMiBydWxlcyBvbmx5IGlmIHlvdSBhcmUgcnVubmluZyBvbiBpMzg2 IG9yIHMzOTAuIERvIG5vdCB1c2UgZm9yIHg4Nl82NCwgaWE2NCwgcHBjLCBwcGM2NCwgb3IgczM5 MHguPC9URD4NCjxURCBhbGlnbj1taWRkbGUgdmFsaWduPXRvcD5BdWRpdCBhbGw8L1REPg0KPC9U Uj4NCjxUUj4NCjxURCBhbGlnbj1sZWZ0IHZhbGlnbj10b3A+PGI+Y3JlYXQgPGJyPm9wZW48L2I+ PC9URD4NCjxURCBhbGlnbj1sZWZ0IHZhbGlnbj10b3A+LWEgZW50cnksYWx3YXlzIC1TIGNyZWF0 IC1TIG9wZW48L1REPg0KPFREIGFsaWduPWxlZnQgdmFsaWduPXRvcD5vcGVucyBhbmQgcG9zc2li bGUgY3JlYXRlcyBmaWxlcyBvciBkZXZpY2VzPC9URD4NCjxURCBhbGlnbj1sZWZ0IHZhbGlnbj10 b3A+bW9uaXRvcnMgYWxsIGZpbGUgYWNjZXNzZXMgb2NjdXJyaW5nIG9uIGEgc3lzdGVtPGJyPjxm b250IGNvbG9yPXJlZD48Yj5XQVJOSU5HOjwvYj4gSW1wbGVtZW50aW5nIHRoaXMgcnVsZSB3aWxs IGNhdXNlIGxhcmdlIGFtb3VudHMgb2YgYXVkaXQgZGF0YSB0byBiZSBwcm9kdWNlZC4gRW5zdXJl IHRoZSBhdWRpdCBwYXJ0aXRpb24gYW5kIGxvZyByZXRlbnRpb24gZmFjaWxpdGllcyBhcmUgY2Fw YWJsZSBvZiBoYW5kbGluZyBsYXJnZSBhbW91bnRzIG9mIGF1ZGl0IGRhdGEgYmVmb3JlIGltcGxl bWVudGluZyB0aGlzIHJ1bGUuPC9mb250PjwvVEQ+DQo8VEQgYWxpZ249bWlkZGxlIHZhbGlnbj10 b3A+QXVkaXQgZmFpbHVyZXMgb25seTwvVEQ+DQo8L1RSPg0KPFRSPg0KPFREIGFsaWduPWxlZnQg dmFsaWduPXRvcD48Yj50cnVuY2F0ZSA8YnI+dHJ1bmNhdGU2NCA8YnI+ZnRydW5jYXRlIDxicj5m dHJ1bmNhdGU2NDwvYj48L1REPg0KPFREIGFsaWduPWxlZnQgdmFsaWduPXRvcD4tYSBlbnRyeSxh bHdheXMgLVMgdHJ1bmNhdGUgLVMgdHJ1bmNhdGU2NCAtUyBmdHJ1bmNhdGUgLVMgZnRydW5jYXRl NjQ8L1REPg0KPFREIGFsaWduPWxlZnQgdmFsaWduPXRvcD50cnVuY2F0ZXMgYSBmaWxlIHRvIGEg c3BlY2lmaWVkIGxlbmd0aDwvVEQ+DQo8VEQgYWxpZ249bGVmdCB2YWxpZ249dG9wPm1vbml0b3Jz IGZpbGUgY29udGVudCBtb2RpZmljYXRpb248YnI+PGI+Tm90ZTo8L2I+IEVuYWJsZSAqNjQgcnVs ZXMgaWYgeW91IGFyZSBydW5uaW5nIG9uIGkzODYsIHBwYywgcHBjNjQgb3IgczM5MC4gRG8gbm90 IHVzZSBmb3IgeDg2XzY0LCBpYTY0LCBvciBzMzkweC48L1REPg0KPFREIGFsaWduPW1pZGRsZSB2 YWxpZ249dG9wPkF1ZGl0IGFsbDwvVEQ+DQo8L1RSPg0KPFRSPg0KPFREIGFsaWduPWxlZnQgdmFs aWduPXRvcD48Yj51bmxpbmsgPGJyPmxpbmsgPGJyPnN5bWxpbmsgPGJyPnJlbmFtZTwvYj48L1RE Pg0KPFREIGFsaWduPWxlZnQgdmFsaWduPXRvcD4tYSBlbnRyeSxhbHdheXMgLVMgdW5saW5rIC1T IGxpbmsgLVMgc3ltbGluayAtcyByZW5hbWU8L1REPg0KPFREIGFsaWduPWxlZnQgdmFsaWduPXRv cD51c2VkIHRvIG1vdmUsIGxpbmsgb3IgZGVsZXRlIGZpbGVzPC9URD4NCjxURCBhbGlnbj1sZWZ0 IHZhbGlnbj10b3A+bW9uaXRvcnMgZmlsZSBtb3ZpbmcsIHJlbW92aW5nLCBhbmQgbGlua2luZzwv VEQ+DQo8VEQgYWxpZ249bWlkZGxlIHZhbGlnbj10b3A+QXVkaXQgYWxsPC9URD4NCjwvVFI+DQo8 VFI+DQo8VEQgYWxpZ249bGVmdCB2YWxpZ249dG9wPjxiPm1rbm9kPC9iPjwvVEQ+DQo8VEQgYWxp Z249bGVmdCB2YWxpZ249dG9wPi1hIGVudHJ5LGFsd2F5cyAtUyBta25vZDwvVEQ+DQo8VEQgYWxp Z249bGVmdCB2YWxpZ249dG9wPmNyZWF0ZXMgYmxvY2sgb3IgY2hhcmFjdGVyIHNwZWNpYWwgZmls ZXM8L1REPg0KPFREIGFsaWduPWxlZnQgdmFsaWduPXRvcD5tb25pdG9ycyB0aGUgY3JlYXRpb24g b2Ygc3BlY2lhbCBmaWxlczwvVEQ+DQo8VEQgYWxpZ249bWlkZGxlIHZhbGlnbj10b3A+QXVkaXQg YWxsPC9URD4NCjwvVFI+DQo8VFI+DQo8VEQgYWxpZ249bGVmdCB2YWxpZ249dG9wPjxiPm1vdW50 IDxicj51bW91bnQgPGJyPnVtb3VudDI8L2I+PC9URD4NCjxURCBhbGlnbj1sZWZ0IHZhbGlnbj10 b3A+LWEgZW50cnksYWx3YXlzIC1TIG1vdW50IC1TIHVtb3VudCAtUyB1bW91bnQyPC9URD4NCjxU RCBhbGlnbj1sZWZ0IHZhbGlnbj10b3A+TW91bnRzIG9yIHVubW91bnRzIGEgZmlsZSBzeXN0ZW08 L1REPg0KPFREIGFsaWduPWxlZnQgdmFsaWduPXRvcD5Nb25pdG9ycyB0aGUgbW91bnRpbmcgb3Ig dW5tb3VudGluZyBvZiBmaWxlIHN5c3RlbXM8YnI+PGI+Tm90ZTo8L2I+IEZvciB4ODZfNjQgYXJj aGl0ZWN0dXJlLCBkaXNhYmxlIHVtb3VudCBydWxlLiBGb3IgaWE2NCBhcmNoaXRlY3R1cmUsIGRp c2FibGUgdW1vdW50MiBydWxlLjwvVEQ+DQo8VEQgYWxpZ249bWlkZGxlIHZhbGlnbj10b3A+QXVk aXQgYWxsPC9URD4NCjwvVFI+DQo8VFI+DQo8VEQgYWxpZ249bGVmdCB2YWxpZ249dG9wPjxiPmNs b25lIDxicj5jbG9uZTIgPGJyPmZvcmsgPGJyPnZmb3JrPC9iPjwvVEQ+DQo8VEQgYWxpZ249bGVm dCB2YWxpZ249dG9wPi1hIGVudHJ5LGFsd2F5cyAtUyBjbG9uZSAtUyBjbG9uZTIgLVMgZm9yayAt UyB2Zm9yazwvVEQ+DQo8VEQgYWxpZ249bGVmdCB2YWxpZ249dG9wPkNyZWF0ZXMgY2hpbGQgcHJv Y2Vzc2VzPC9URD4NCjxURCBhbGlnbj1sZWZ0IHZhbGlnbj10b3A+bW9uaXRvcnMgdGhlIGNyZWF0 aW9uIG9mIGNoaWxkIHByb2Nlc3Nlczxicj48Yj5Ob3RlOjwvYj4gRm9yIGlhNjQgYXJjaGl0ZWN0 dXJlLCBkaXNhYmxlIGZvcmsgYW5kIHZmb3JrIGFuZCBlbmFibGUgY2xvbmUyLiA8YnI+PGZvbnQg Y29sb3I9cmVkPjxiPldBUk5JTkc6PC9iPiBJbXBsZW1lbnRpbmcgdGhpcyBydWxlIHdpbGwgY2F1 c2UgbGFyZ2UgYW1vdW50cyBvZiBhdWRpdCBkYXRhIHRvIGJlIHByb2R1Y2VkLiBFbnN1cmUgdGhl IGF1ZGl0IHBhcnRpdGlvbiBhbmQgbG9nIHJldGVudGlvbiBmYWNpbGl0aWVzIGFyZSBjYXBhYmxl IG9mIGhhbmRsaW5nIGxhcmdlIGFtb3VudHMgb2YgYXVkaXQgZGF0YSBiZWZvcmUgaW1wbGVtZW50 aW5nIHRoaXMgcnVsZS48L2ZvbnQ+PC9URD4NCjxURCBhbGlnbj1taWRkbGUgdmFsaWduPXRvcD5v ZmY8L1REPg0KPC9UUj4NCjxUUj4NCjxURCBhbGlnbj1sZWZ0IHZhbGlnbj10b3A+PGI+dW1hc2s8 L2I+PC9URD4NCjxURCBhbGlnbj1sZWZ0IHZhbGlnbj10b3A+LWEgZW50cnksYWx3YXlzIC1TIHVt YXNrPC9URD4NCjxURCBhbGlnbj1sZWZ0IHZhbGlnbj10b3A+dXNlciBmaWxlIGNyZWF0aW9uIG1h c2s8L1REPg0KPFREIGFsaWduPWxlZnQgdmFsaWduPXRvcD5tb25pdG9ycyBjaGFuZ2VzIHRvIHVt YXNrIHNldHRpbmdzPC9URD4NCjxURCBhbGlnbj1taWRkbGUgdmFsaWduPXRvcD5BdWRpdCBhbGw8 L1REPg0KPC9UUj4NCjxUUj4NCjxURCBhbGlnbj1sZWZ0IHZhbGlnbj10b3A+PGI+YWRqdGltZXgg PGJyPnNldHRpbWVvZmRheTwvYj48L1REPg0KPFREIGFsaWduPWxlZnQgdmFsaWduPXRvcD4tYSBl bnRyeSxhbHdheXMgLVMgYWRqdGltZXggLVMgc2V0dGltZW9mZGF5PC9URD4NCjxURCBhbGlnbj1s ZWZ0IHZhbGlnbj10b3A+Y2hhbmdlcyB0aGUgc3lzdGVtIHRpbWU8L1REPg0KPFREIGFsaWduPWxl ZnQgdmFsaWduPXRvcD5tb25pdG9ycyBjaGFuZ2VzIHRvIHRoZSBzeXN0ZW0gdGltZTwvVEQ+DQo8 VEQgYWxpZ249bWlkZGxlIHZhbGlnbj10b3A+QXVkaXQgYWxsPC9URD4NCjwvVFI+DQo8VFI+DQo8 VEQgYWxpZ249bGVmdCB2YWxpZ249dG9wPjxiPnJlYm9vdDwvYj48L1REPg0KPFREIGFsaWduPWxl ZnQgdmFsaWduPXRvcD4tYSBlbnRyeSwgYWx3YXlzIC1TIHJlYm9vdDwvVEQ+DQo8VEQgYWxpZ249 bGVmdCB2YWxpZ249dG9wPnJlYm9vdCBvciBlbmFibGUvZGlzYWJsZSBDdHJsLUFsdC1EZWw8L1RE Pg0KPFREIGFsaWduPWxlZnQgdmFsaWduPXRvcD5tb25pdG9ycyBzeXN0ZW0gcmVib290czwvVEQ+ DQo8VEQgYWxpZ249bWlkZGxlIHZhbGlnbj10b3A+QXVkaXQgYWxsPC9URD4NCjwvVFI+DQo8L1RB QkxFPg0KDQo8Y2VudGVyPg0KPGEgaHJlZj0iamF2YXNjcmlwdDp3aW5kb3cuY2xvc2UoKSI+Q2xv c2U8L2E+DQo8L2NlbnRlcj4NCg0KPC9CT0RZPg0KPC9IVE1MPg== --00235407f00653dd7a047159511e Content-Type: text/plain; charset="us-ascii" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit Content-Disposition: inline --00235407f00653dd7a047159511e--