Should open syscall records occur without a path record?
Steve Grubb
sgrubb at redhat.com
Mon Jul 23 13:51:46 UTC 2007
On Monday 23 July 2007 09:09:22 John D. Ramsdell wrote:
> Is it appropriate for audit analysis programs to assume a PATH record
> will be available with every open syscall event? I cannot see how to
> do my analysis without the PATH record.
There should be a PATH record for every open. Have you verified the logs or
trusting ausearch? (Trying to figure out if there is a kernel problem or
search problem.) As a first step, I'd construct some kind of regex command to
see if you can verify that the kernel is recording PATH records for all
opens. You may need to narrow the test case so that there aren't as many
records to dig through.
-Steve
More information about the Linux-audit
mailing list