Re: Should open syscall records occur without a path record?

[ramsdell@mitre.org (John D. Ramsdell)]

Steve Grubb <sgrubb@redhat.com> writes:

> There should be a PATH record for every open.

Okay, I'll direct my search as you suggested.  I'll delete the current
audit log, restart my daemon, run the test suite, and then compare the
raw log with what one gets from ausearch.  I'll modify my python
program to print the timestamp of an open event without a path, easing
the task of finding the record in the raw data.  Alas, the part of my
day free of meetings is at an end, but I'll get on this soon.

John

PS.  The output of my program should have said:

$ python auditopen.py -i ../autsv/*.txt
Of 421 events with a SYSCALL record with syscall=open
401 have CWD
397 have PATH
0 have PATH but no CWN
$

The last line in the original message erroneously said:

0 have CWD but no PATH