<div>Hi Steve,</div><div><br></div><div>Thanks for the suggestion on read/write. I have two more questions which I haven't figured out.</div><div>1) Does auditctl rules support regular expressions? For some params, it is not easy to filter specific messages using “=” or "!=".</div><div>2) In message payload, some fields are not what we care about. Any way we can reduce the fields/params in audit log?</div><div><br></div><div>Regards</div><div>Hai</div><div><includetail><div> </div><div> </div><div style="font:Verdana normal 14px;color:#000;"><div style="FONT-SIZE: 12px;FONT-FAMILY: Arial Narrow;padding:2px 0 2px 0;">------------------ Original ------------------</div><div style="FONT-SIZE: 12px;background:#efefef;padding:8px;"><div id="menu_sender"><b>From: </b> "Steve Grubb"<sgrubb@redhat.com>;</div><div><b>Date: </b> Thu, Jul 25, 2019 10:51 PM</div><div><b>To: </b> "杨海"<hai.yang@magic-shield.com>; <wbr></div><div><b>Cc: </b> "linux-audit"<linux-audit@redhat.com>; <wbr></div><div><b>Subject: </b> Re: How to filter PROCTITLE events</div></div><div> </div><div style="position:relative;"><div id="tmpcontent_res"></div>On Thursday, July 25, 2019 1:44:07 AM EDT 杨海 wrote:<br>> Thanks Steve. It works :-)<br>> Meanwhile, for read/write system call, if they belongs to same pid and same<br>> fd, we are trying to suppress them into one msg. I guess it would not be<br>> able to filter using auditctl, is that right?<br><br>Technically you could suppress them. In practice, it's not feasible. You <br>would need to have application specific rules to suppress. The more rules you <br>have the more performance you lose.<br><br>But I would start by questioning whether you really need to monitor reads and <br>writes? If a file is opened with O_WRONLY or O_RDWR, can it just be assumed <br>that the file was written to?<br><br>-Steve<br><br></div></div></includetail></div>