On Wednesday 23 December 2009 02:58:13 am Adan wrote: > Right now , I want to add it to the audit project to make it response to > the event at the same time. What should I do?
You need to take this file: https://fedorahosted.org/audit/browser/trunk/contrib/plugin/audisp-example.conf Fill it out with the path to your executable and set active to yes. Then install it to /etc/audisp/plugins.d/ and restart the audit daemon. You should be able to do a "ps -ef" and see your plugin is running. The location that your plugin installs to should probably be /sbin and if your plugin needs a configuration file, it could be located anywhere inside /etc. I generally choose /etc/audisp for SE Linux reasons, but you can put it anywhere. -Steve -- Linux-audit mailing list [email protected] https://www.redhat.com/mailman/listinfo/linux-audit
