Wish List...

Tue Oct 19 00:00:10 UTC 2010

All:

So here's one for the wish list... It would be exceedingly nice to have "not logic" in ausearch. So here's my problem, I have a ton of file watches for my Web Application content. I have one account that loads content. So I'd like to generate a report of any user other than the account that is authorized to load the content. So what I'd like is something like:

ausearch -i -ua ! ContentAccount

I'm not particularly in love with the syntax above but anything that provides this functionality would be incredibly useful, especially if it was generalized to all options, and could be intermixed with positive tests as "Ands, or Ors"... But just the "Not" would be incredibly helpful.

Any thoughts?

Regards,

Jim

-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://listman.redhat.com/archives/linux-audit/attachments/20101018/e860f0e3/attachment.htm>