How to make sure a specific event is logged with thge proper message type?
Alarie, Maxime
Alarie.Maxime at hydro.qc.ca
Mon Jul 6 14:02:32 UTC 2015
Hi,
I have this rule in audit.rules : -w /usr/sbin/useradd -p x -k user_modification
When I add a user, and do a ausearch -m ADD_USER I get 0 match. Am I doing something wrong here? I am using version 1.8.
Thanks
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://listman.redhat.com/archives/linux-audit/attachments/20150706/cf5dd881/attachment.htm>
More information about the Linux-audit
mailing list