On Tuesday, April 08, 2014 10:53:40 AM Satish Chandra Kilaru wrote: > Hi > > I want to understand the logs in /var/log/audit/audit.log. Where can I get > complete list of audit event types
ausearch -m help 2>&1 | tr ' ' '\n' | egrep '^[A-Z]' | egrep -v 'ALL|Valid' | sort > and what they mean? Each event type has some comment in the header files /usr/include/libaudit.h and /usr/include/linux/audit.h. There is also some documentation here: https://access.redhat.com/site/documentation/en-US/Red_Hat_Enterprise_Linux/6/html/Security_Guide/sec-Understanding_Audit_Log_Files.html And I want to think some other distros have docs as well. -Steve -- Linux-audit mailing list [email protected] https://www.redhat.com/mailman/listinfo/linux-audit
