
key
If you are auditing a large number of directories or files, assign key strings each
of these watches. You can use these keys with
ausearch
to search the logs for
events of this type only.
The second message triggered by the example
less
call does not reveal anything apart
from just the current working directory when the
less
command was executed.
The third message reveals the following (the
type
and
message
flags have already
been introduced):
item
In this example,
item
references the
a0
argument—a path—that is associated
with the original
SYSCALL
message. Had the original call had more than one path
argument (such as a
cp
or
mv
command), an additional
PATH
event would have
been logged for the second path argument.
name
Refers to the pathname passed as an argument to the
less
(or
open
) call.
inode
Refers to the inode number corresponding to
name
.
dev
Specifies the device on which the file is stored. In this case,
03:01
, which stands
for
/dev/sda1
or “first partition on the first IDE device.”
mode
Numerical representation of the file's access permissions. In this case,
root
has
read and write permissions and his group (
root
) has read access while the entire
rest of the world cannot access the file at all.
ouid
and
ogid
Refer to the UID and GID of the inode itself.
rdev
Not applicable for this example. The
rdev
entry only applies to block or character
devices, not to files.
Understanding Linux Audit
395
Summary of Contents for LINUX ENTERPRISE DESKTOP 11
Page 1: ...SUSE Linux Enterprise Server www novell com 11 March 17 2009 Security Guide...
Page 9: ...32 7 Managing Audit Event Records Using Keys 433 33 Useful Resources 435...
Page 10: ......
Page 29: ...Part I Authentication...
Page 30: ......
Page 55: ...Figure 4 2 YaST LDAP Server Configuration LDAP A Directory Service 41...
Page 126: ......
Page 127: ...Part II Local Security...
Page 128: ......
Page 158: ......
Page 173: ...Part III Network Security...
Page 174: ......
Page 194: ......
Page 197: ...Figure 16 2 Scenario 2 Figure 16 3 Scenario 3 Configuring VPN Server 183...
Page 210: ......
Page 228: ......
Page 229: ...Part IV Confining Privileges with Novell AppArmor...
Page 230: ......
Page 274: ......
Page 300: ......
Page 328: ......
Page 340: ......
Page 342: ......
Page 386: ......
Page 387: ...Part V The Linux Audit Framework...
Page 388: ......