Sucess or failure?

Michael Mather michael.mather at teksavvy.com
Sun Jul 22 01:48:12 UTC 2012


Hi,

I enter the command "sudo cp qwerty /etc/xxx"
and get the reply:  "cp: cannot stat `qwerty': No such file or directory."

A number of log entries are written. The last two are, in part:

type=SYSCALL success=yes
type=EXECVE  argc=3 a0="cp" a1="qwerty" a2="/etc/xxx"

My problem is with "success=yes".

What is happening?

Thanks - Michael Mather
-----------------------






More information about the Linux-audit mailing list