Help with audit syscall event output

[Ankitha Kundhuru]

Awesome, thanks!

Thanks & Regards,
Ankitha Kundhuru


On Tue, Sep 3, 2019 at 5:24 PM Steve Grubb <sgrubb at redhat.com> wrote:

> On Tuesday, September 3, 2019 5:15:29 PM EDT Ankitha Kundhuru wrote:
> > Any help is greatly appreciated.
> >
> > My piece of code can read audit.log file and process it.But when I enable
> > good number of syscalls, disk gets filled really quick (15GB for half a
> day
> > usage)
> > I wanted to know if there is a way to directly get the events from
> > userspace audit daemon instead of writing it to a file. Plan is that my
> > application should process the events as soon as they are created.
>
> Yes, there is a presentation that describes the architecture of the audit
> system including the realtime event interface:
>
> http://people.redhat.com/sgrubb/audit/audit_ids_2011.pdf
>
> And there is sample code for a plugin here:
>
> https://github.com/linux-audit/audit-userspace/tree/master/contrib/plugin
>
> -Steve
>
>
>
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://listman.redhat.com/archives/linux-audit/attachments/20190903/0d27d7a3/attachment.htm>