On Tuesday, April 22, 2014 03:44:45 PM Boyce, Kevin P. wrote: > Does the audit subsystem have the ability to dynamically create new > auditing rules using another event as the trigger?
There was a patch for a reactive plugin sent to the list a number of years ago. The patch was too big and bounced, but I was cc'ed and have a copy. I have not had the time to review it to see if its maintainable, supportable, and exactly what I'd want. It's actually pretty well documented. I could probably make it available off my people page since its too large for the mail list. -Steve -- Linux-audit mailing list [email protected] https://www.redhat.com/mailman/listinfo/linux-audit
