On 06/08/2009 01:12 PM, John Dennis wrote:
Joshua Roys wrote:
Hello all.
As part of developing an audit viewing "plugin"[1] to Spacewalk[2], I
wrote a small program to use libauparse to output (easily)
machine-parsable audit logs. I think this functionality would be nice
to have in ausearch, and as such, wrote a patch for it.
As well as reviewing this patch, I would like your feedback concerning
the Spacewalk audit plugin. Any questions or constructive criticism is
welcome.
Would you please post an example of the output and/or the parsing rules.
Thanks
Basically the following:
type=USER_ACCT
serial=222
seconds=1244481001
milli=141
user pid=24777
uid=root
auid=unset
ses=4294967295
subj=system_u:system_r:crond_t:s0-s0:c0.c1023
op=PAM:accounting
acct=root
exe=/usr/sbin/crond
hostname=?
addr=?
terminal=cron
res=success
----
type=CRED_ACQ
serial=223
seconds=1244481001
milli=141
user pid=24777
uid=root
auid=unset
ses=4294967295
subj=system_u:system_r:crond_t:s0-s0:c0.c1023
op=PAM:setcred
acct=root
exe=/usr/sbin/crond
hostname=?
addr=?
terminal=cron
res=success
----
type=LOGIN
serial=224
seconds=1244481001
milli=141
login pid=24777
uid=root
old auid=unset
new auid=root
old ses=4294967295
new ses=34
----
Simply key=value with all nodes separated by "----\n". I should note
that the patch has not been exhaustively tested, it's more of a RFC and
also a request for those more knowledgeable of the audit logs to improve
upon it.
Thanks,
Joshua Roys
--
Linux-audit mailing list
[email protected]
https://www.redhat.com/mailman/listinfo/linux-audit
