filtering on inode ouid
Peter Moody
auditd at hda3.com
Tue Nov 8 22:25:54 UTC 2011
Apologies if this is the wrong list:
Is it possible to filter on what shows up in the audit logs as the ouid of
an inode being accessed?
Alternatively, if I'm only interested in inodes of a particular ouid (or
more specifically, accesses to an inode of a particular ouid from a process
with a different uid), is my best bet doing post-audit filtering?
cheers,
peter
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://listman.redhat.com/archives/linux-audit/attachments/20111108/fcf2c3db/attachment.htm>
More information about the Linux-audit
mailing list