Audit rule problem
Roger Holm
roger.holm at bwin.org
Tue Jul 17 14:05:12 UTC 2007
Hello.
I wonder if someone can help me with an audit rule issue?
I want to log if someone uses the rpm command (to install/upgrade
packages), but not the rest of commands. Only the rpm command!
Is it possible? If so, can anyone please tell me how to write the rule
string? I've searched the internet, without success.
Regards
Roger Holm
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://listman.redhat.com/archives/linux-audit/attachments/20070717/02c77be3/attachment.htm>
More information about the Linux-audit
mailing list