How to make sure a specific event is logged with thge proper message type?

[Alarie, Maxime]

Thanks for the reply.

Of course :)  I also  tried DEL_USER on a deleted user, and nothing gets logged under that  type, also I never get the hostname and addr fileds filled up..  Its always  hostname=? And addr=?

Help is aprecited.


De : Boyce, Kevin P (AS) [mailto:Kevin.Boyce at ngc.com]
Envoyé : 6 juillet 2015 11:08
À : Alarie, Maxime; linux-audit at redhat.com
Objet : RE: How to make sure a specific event is logged with thge proper message type?

OK this may be obvious but have you actually tried using useradd to create an account before running your ausearch?

From: linux-audit-bounces at redhat.com<mailto:linux-audit-bounces at redhat.com> [mailto:linux-audit-bounces at redhat.com] On Behalf Of Alarie, Maxime
Sent: Monday, July 06, 2015 10:03 AM
To: linux-audit at redhat.com<mailto:linux-audit at redhat.com>
Subject: EXT :How to make sure a specific event is logged with thge proper message type?

Hi,

I have this rule in audit.rules : -w /usr/sbin/useradd -p x -k user_modification

When I add a user, and do a ausearch -m ADD_USER   I get 0 match.  Am I doing something wrong here?  I am using version 1.8.




Thanks

-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://listman.redhat.com/archives/linux-audit/attachments/20150706/72d7f9e6/attachment.htm>