What does the hex number after arch= mean? 64bit seems to always be c000003e and 32bit seems to be 40000003, but I'd feel a lot better setting up log monitoring if I knew what they actually represented.
$ sudo auditctl -l LIST_RULES: exit,always arch=3221225534 (0xc000003e) ... Cheers, peter -- Peter Moody Google 1.650.253.7306 Security Engineer pgp:0xC3410038 -- Linux-audit mailing list [email protected] https://www.redhat.com/mailman/listinfo/linux-audit
