Steve, Audit 1.6.7 prelude event adds look great - the extra info in the prelude manager is very good.
Events: In the audisp code I see most of the AUDIT_ANOM "biggies" but not all (from libaudit.h, e.g. AUDIT_ANOM_ROOT_TRANS)? Also - gotta ask - user logins but not logoffs? Thanks, LCB. -- LC (Lenny) Bruzenak [EMAIL PROTECTED] -- Linux-audit mailing list [email protected] https://www.redhat.com/mailman/listinfo/linux-audit
