Why doesn't chown produce an event

Steve Grubb sgrubb at redhat.com
Wed May 2 18:15:15 UTC 2007


On Wednesday 02 May 2007 14:00, Robert Evans wrote:
> Got it!  So when I want to figure out how to trace something, the
> recommended course of action is do a strace on the operation, and look for
> a good syscall to tag...

You should do that whenever you don't get a hit when you think you should. It 
should also be trivial for me to write a simple app that iterates the 
syscalls it knows about for a given arch.

-Steve




More information about the Linux-audit mailing list