<html><body> <tt>linux-audit-bounces@redhat.com wrote on 08/09/2007 07:34:06 AM: </tt> <tt>Hi Matt,</tt> <tt> > Questions relate to RHEL4 (unless they don't). > > What are the meanings of the following fields from the SYSCALL record: > * items</tt> <tt> </tt><tt>the number of path records in the event</tt><tt> </tt> <tt>> * fsuid</tt> <tt> Filesystem User ID</tt> <tt> > * fsgid</tt> <tt> Filesystem Group ID > > What are the meanings of the following fields from the PATH record: > * flags</tt> <tt> </tt><tt>file system namei flags</tt> <tt> > * rdev</tt> <tt> device identifier > > How can I programmatically translate an architecture into human, eg > 40000003 => 'i686'?</tt> <tt>When creating a rule with auditctl, you should be able to use either 'b32' or 'b64' for the architecture.</tt> <tt>If you're trying to read the audit log, ausearch has an option "-i" that interprets numeric items into text. I'm not sure how well it works with the arch fields, but might be worth a try.</tt> <tt> > > Is there a way of doing a syscall name lookup without having root?</tt> <tt>Without root access, I'm not sure. You could probably find the syscall table for your arch type online.</tt> <tt> > > In RHEL5, what's the equivalent of 'auditctl -t'?</tt> <tt>Sorry I've forgotten what -t meant in auditctl.</tt> <tt> > > Is there any master documentation I've missed? I'm only aware of the man > pages.</tt> <tt><a href="http://people.redhat.com/sgrubb/audit/">http://people.redhat.com/sgrubb/audit/</a></tt> <tt>Hope that helps,</tt> <tt>debora</tt> <tt>----</tt> <tt>Debora Velarde</tt> <tt>Linux Security</tt> <tt>IBM Linux Technology Center</tt> </body></html>