On Tuesday 20 November 2007 07:49:00 pm Mike Nixon wrote: > Looks to me like someone that was logged in as 'root' attempted but failed > to read a x-windows file. The relevant tipoffs are: > > syscall=3 (read) > success=no (failed) > uid=0 (root user account) > comm="X" or exe="/usr/X11R6/bin/Xorg"
You are forgetting the exit code. In this case, it matters. :) -Steve -- Linux-audit mailing list [email protected] https://www.redhat.com/mailman/listinfo/linux-audit
