Steve Grubb <[EMAIL PROTECTED]> writes: > There should be a PATH record for every open.
Okay, I'll direct my search as you suggested. I'll delete the current audit log, restart my daemon, run the test suite, and then compare the raw log with what one gets from ausearch. I'll modify my python program to print the timestamp of an open event without a path, easing the task of finding the record in the raw data. Alas, the part of my day free of meetings is at an end, but I'll get on this soon. John PS. The output of my program should have said: $ python auditopen.py -i ../autsv/*.txt Of 421 events with a SYSCALL record with syscall=open 401 have CWD 397 have PATH 0 have PATH but no CWN $ The last line in the original message erroneously said: 0 have CWD but no PATH -- Linux-audit mailing list [email protected] https://www.redhat.com/mailman/listinfo/linux-audit
