Re: Audit Explanations

From: Darren J Moffat (darrenm@eng.sun.com)
Date: 08/14/01 

Date: Tue, 14 Aug 2001 10:07:35 -0700 (PDT)
From: Darren J Moffat <darrenm@eng.sun.com>
To: Jeff Leckemby <Jeff.Leckemby@sptrm.com>
Subject: Re: Audit Explanations
Message-ID: <Pine.GSO.4.21.0108141005410.162164-100000@jurassic>

On Tue, 14 Aug 2001, Jeff Leckemby wrote:

> explains, tells, deciphers what the text in a typical audit record means.
> Granted some are obvious, f.e. chmod and login entries... but others aren't
> so easily defined. I am familiar with Audit Token Structure, praudit and
> auditreduce, docs.sun.com. etc., but these sources/tools haven't been too
> helpful. If any of you know of where I can look for explanations of audit
> events I would be truly grateful for your help. I have attached a snippet
> of an audit file below for reference.

You need to be a lot more specific in what you want to know.

What parts of the audit records you listed do you not understand ?
What is it you are trying to achieve ? 

--
Darren J Moffat

Relevant Pages

  • [PATCH] Light-weight Auditing Framework
    ... as the ability to audit system calls, ... void do_syscall_trace ... int fastcall path_lookup ... +/* The audit_buffer is used when formatting an audit record. ...
    (Linux-Kernel)
  • Re: Is it a facade
    ... >> The classes inside the Audit Module under consideration is building ... >> this Audit record. ... > Normally an original audit record is pretty simple and is easily ... > activity is different, probably with different clients). ...
    (comp.object)
  • RE: CBO Selection utilizing the same table
    ... Use the IDAudit and the New "AuditVersion" as a composite primary key. ... the IDAudit and Audit Version. ... To use the combo to look up an audit record, ... a date range and a client among other fields. ...
    (microsoft.public.access.forms)
  • RE: Audit Explanations
    ... Subject: Audit Explanations ... Jeff Leckemby wrote: ... > subject,someuser,someuser,staff,someuser,staff,313,312,0 0 someputer ...
    (Focus-SUN)
  • RE: Audit Explanations
    ... Subject: Audit Explanations ... Per your reply "What parts of the audit records you listed do you not ... On Tue, 14 Aug 2001, Jeff Leckemby wrote: ...
    (Focus-SUN)