On Thursday, January 05, 2012 11:44:57 AM Marcelo Cerri wrote: > But I'm not sure what means "anomaly events". Would it be malformed > records (without some fields, for example) or a specific record type > generated by the kernel or some other userspace application?
No, these are events in the range of AUDIT_FIRST_ANOM_MSG and AUDIT_LAST_ANOM_MSG and some from the kernel in the range of AUDIT_FIRST_KERN_ANOM_MSG and AUDIT_LAST_KERN_ANOM_MSG. -Steve -- Linux-audit mailing list [email protected] https://www.redhat.com/mailman/listinfo/linux-audit
