On Monday, August 16, 2010 08:49:48 pm Basim Baig wrote: > If i am taking my data stream through the af_unix socket built-in plugin > then will i get the audit_eoe event?
For an audispd plugin, you would need to set the format parameter to binary. See the sample conf file: https://fedorahosted.org/audit/browser/trunk/contrib/plugin/audisp-example.conf or the audisp man page for discussion on each parameter's values. > Do i have to setup some special rule to get this event or is it there by > default > in the af_unix plugin stream? The default is to turn things into strings so that they can be used by the auparse library. But the binary setting means you are willing to follow all the rules and do it yourself however painful that may be. :) I think they are here: http://people.redhat.com/sgrubb/audit/audit-rt-events.txt You can probably use the same code as this: https://fedorahosted.org/audit/browser/trunk/contrib/skeleton.c to write your plugin. -Steve -- Linux-audit mailing list [email protected] https://www.redhat.com/mailman/listinfo/linux-audit
