<html><head><meta http-equiv="Content-Type" content="text/html charset=utf-8"></head><body style="word-wrap: break-word; -webkit-nbsp-mode: space; -webkit-line-break: after-white-space;" class="">Hello,<div class=""><br class=""></div><div class="">According to this [1] and the definition of the res field here [2], the res field should have a value of either success or fail.</div><div class=""><br class=""></div><div class="">Here are some logs I generated on Debian:</div><div class=""><br class=""></div><div class="">type=USER_START msg=audit(1464013671.525:405): pid=3569 uid=0 auid=1000 ses=7 msg='op=PAM:session_open acct="root" exe="/usr/bin/sudo" hostname=? addr=? terminal=/dev/pts/1 res=success'<br class="">type=CONFIG_CHANGE msg=audit(1464013671.541:406): auid=1000 ses=7 op="add rule" key=(null) list=4 res=1<br class="">type=USER_END msg=audit(1464013671.549:407): pid=3569 uid=0 auid=1000 ses=7 msg='op=PAM:session_close acct="root" exe="/usr/bin/sudo" hostname=? addr=? terminal=/dev/pts/1 res=success’</div><div class=""><br class=""></div><div class="">As you can see, there is a res field which value is 1.</div><div class=""><br class=""></div><div class="">Is it because my auditd is outdated? Is there a missing res field which is purely numeric (just like the fields called fp [3])?</div><div class=""><br class=""></div><div class="">As Steve said in previous emails, it is possible and it might be fixed already. I’ll try to find out if I get similar logs with the latest auditd (2.6.5) on CentOS 6.8-i386 later.</div><div class=""><br class=""></div><div class="">Cheers!</div><div class=""><br class=""></div><div class="">-m<br class=""></div><div class=""><br class=""></div><div class="">[1]: <a href="https://github.com/linux-audit/audit-userspace/blob/ac9384a884841ef66b4cae42884d9e63d0b6a438/auparse/typetab.h#L79-L80" class="">https://github.com/linux-audit/audit-userspace/blob/ac9384a884841ef66b4cae42884d9e63d0b6a438/auparse/typetab.h#L79-L80</a></div><div class="">[2]: <a href="https://github.com/linux-audit/audit-documentation/blob/master/specs/fields/field-dictionary.csv#L186" class="">https://github.com/linux-audit/audit-documentation/blob/master/specs/fields/field-dictionary.csv#L186</a></div><div class="">[3]: <a href="https://github.com/linux-audit/audit-documentation/blob/master/specs/fields/field-dictionary.csv#L62-L63" class="">https://github.com/linux-audit/audit-documentation/blob/master/specs/fields/field-dictionary.csv#L62-L63</a></div></body></html>