<html><head><style type='text/css'>p { margin: 0; }</style></head><body><div style='font-family: Times New Roman; font-size: 12pt; color: #000000'>----- "Jure Simsic" <jure.simsic@gmail.com> wrote:
<br>> Hi<br>> <br>> I need to audit some specific commands which have the following form<br>> <br>> cmd -arg1 -arg2 -query 'some query("args")'<br>> <br>> In audit log I get a record like:<br>> type=EXECVE msg=audit(1282117611.037:27469599): argv<span class="error">[0]</span>="cmd" argv<span class="error">[1]</span>="-arg1" argv<span class="error">[2]</span>="-arg2" argv<span class="error">[3]</span>="-query" argv<span class="error">[4]</span>=737472626567696E73287468726561645F69642C227468726561645F69643D32333639383932662229 <br>>
<br>> Now, I'd really need to get the last query argument in an
understandable form. Is this possible or is this the way it is and I
can't do it?<br>(ausearch -i), at least in recent versions.<br>
Mirek<br>
</div></body></html>