On Monday 23 July 2007 09:09:22 John D. Ramsdell wrote: > Is it appropriate for audit analysis programs to assume a PATH record > will be available with every open syscall event? I cannot see how to > do my analysis without the PATH record.
There should be a PATH record for every open. Have you verified the logs or trusting ausearch? (Trying to figure out if there is a kernel problem or search problem.) As a first step, I'd construct some kind of regex command to see if you can verify that the kernel is recording PATH records for all opens. You may need to narrow the test case so that there aren't as many records to dig through. -Steve -- Linux-audit mailing list [email protected] https://www.redhat.com/mailman/listinfo/linux-audit
