From mboxrd@z Thu Jan 1 00:00:00 1970 From: ramsdell@mitre.org (John D. Ramsdell) Subject: Re: Should open syscall records occur without a path record? Date: 23 Jul 2007 10:07:48 -0400 Message-ID: References: <200707230951.46896.sgrubb@redhat.com> Mime-Version: 1.0 Content-Type: text/plain; charset=us-ascii Return-path: In-Reply-To: <200707230951.46896.sgrubb@redhat.com> List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Sender: linux-audit-bounces@redhat.com Errors-To: linux-audit-bounces@redhat.com To: Steve Grubb Cc: linux-audit@redhat.com List-Id: linux-audit@redhat.com Steve Grubb writes: > There should be a PATH record for every open. Okay, I'll direct my search as you suggested. I'll delete the current audit log, restart my daemon, run the test suite, and then compare the raw log with what one gets from ausearch. I'll modify my python program to print the timestamp of an open event without a path, easing the task of finding the record in the raw data. Alas, the part of my day free of meetings is at an end, but I'll get on this soon. John PS. The output of my program should have said: $ python auditopen.py -i ../autsv/*.txt Of 421 events with a SYSCALL record with syscall=open 401 have CWD 397 have PATH 0 have PATH but no CWN $ The last line in the original message erroneously said: 0 have CWD but no PATH