Why doesn't chown produce an event
Steve Grubb
sgrubb at redhat.com
Wed May 2 18:15:15 UTC 2007
On Wednesday 02 May 2007 14:00, Robert Evans wrote:
> Got it! So when I want to figure out how to trace something, the
> recommended course of action is do a strace on the operation, and look for
> a good syscall to tag...
You should do that whenever you don't get a hit when you think you should. It
should also be trivial for me to write a simple app that iterates the
syscalls it knows about for a given arch.
-Steve
More information about the Linux-audit
mailing list