[PATCH 1/2] Audit: break up execve arguments into multiple records

Steve Grubb sgrubb at redhat.com
Wed Oct 3 17:26:16 UTC 2007


On Wednesday 03 October 2007 13:21:58 Eric Paris wrote:
> > Do you have an example of what the event would look like with this patch
> > applied?
>
> attached.  That is 100k or so of execve args, wow!

Looks good, thanks. I just wanted to make sure everyone could see how this 
would turn out.

-Steve




More information about the Linux-audit mailing list