Audit Parsing Library Requirements

Steve Grubb sgrubb at redhat.com
Thu Mar 9 18:59:01 UTC 2006


On Thursday 09 March 2006 11:48, Michael C Thompson wrote:
> What sort of search options can you set?

Oh...how about any?

> Are these basically the same that ausearch allows? 

We could limit it to that and it would be faster...or it could be more. Do we 
need to search on all field or just have access to all fields?

-Steve




More information about the Linux-audit mailing list