Add a plugin

[Steve Grubb]

On Wednesday 23 December 2009 02:58:13 am Adan wrote:
>  Right now , I want to add it to the audit project to make it response to
>  the event at the same time. What should I do?

You need to take this file:

https://fedorahosted.org/audit/browser/trunk/contrib/plugin/audisp-example.conf

Fill it out with the path to your executable and set active to yes.
Then install it to /etc/audisp/plugins.d/  and restart the audit daemon.
You should be able to do a "ps -ef" and see your plugin is running.
The location that your plugin installs to should probably be /sbin
and if your plugin needs a configuration file, it could be located
anywhere inside /etc. I generally choose /etc/audisp for SE Linux
reasons, but you can put it anywhere.

-Steve