open record looks like openat

Wieprecht, Karen M. Karen.Wieprecht at jhuapl.edu
Fri Jul 27 17:41:58 UTC 2007


I'm probably out of my league by responding here,  but some syscall
records do have more than one path.  For instance,  

	mv file1 file2

will have a path record for both file1 and file2 ...  The same type of
thing is true for cp file1 file2

Karen Wieprecht   




More information about the Linux-audit mailing list