<div>Thanks Steve. It works :-)</div><div>Meanwhile, for read/write system call, if they belongs to same pid and same fd, we are trying to suppress them into one msg. I guess it would not be able to filter using auditctl, is that right?</div><div><br></div><div><sign signid="98"><div style="color:#909090;font-family:Arial Narrow;font-size:12px">Regards</div><div style="color:#909090;font-family:Arial Narrow;font-size:12px">Hai<br><br></div><div style="font-size:14px;font-family:Verdana;color:#000;"><div style="overflow:hidden;"><table class="preview_table"><tbody><tr><td valign="middle"><div><br></div></td><td valign="middle" style="color:#a0a0a0;font-size:12px;"></td></tr></tbody></table></div></div></sign></div><div></div><div><includetail><div> </div><div> </div><div style="font:Verdana normal 14px;color:#000;"><div style="FONT-SIZE: 12px;FONT-FAMILY: Arial Narrow;padding:2px 0 2px 0;">------------------ Original ------------------</div><div style="FONT-SIZE: 12px;background:#efefef;padding:8px;"><div id="menu_sender"><b>From: </b> "Steve Grubb"<sgrubb@redhat.com>;</div><div><b>Date: </b> Wed, Jul 24, 2019 08:14 PM</div><div><b>To: </b> "linux-audit"<linux-audit@redhat.com>; <wbr></div><div><b>Cc: </b> "杨海"<hai.yang@magic-shield.com>; <wbr></div><div><b>Subject: </b> Re: How to filter PROCTITLE events</div></div><div> </div><div style="position:relative;"><div id="tmpcontent_res"></div>On Wednesday, July 24, 2019 5:27:59 AM EDT 杨海 wrote:<br>> Hi<br>> <br>> I am looking for the method to filter the PROCTITLE events via auditctl.<br>> <br>> It is said we can do it, but I could not figure out how.<br><br>Did you read about the exclude filter? :-)<br><br>> "The proctitle event is emitted during syscall audits, and can be filtered<br>> with auditctl."<br><br>-a always,exclude -F msgtype=PROCTITLE<br><br>There is another example in the 20-dont-audit.rules file.<br><br>-Steve<br><br></div></div></includetail></div>