FS_Chdir audit record generated when not requested.

From: Jim Lane (JLane@TORONTOHYDRO.COM)
Date: Fri Feb 07 2003 - 11:08:02 EST

• Next message: Ignacio Vidal: "Re: SSHD 3004-004 You must "exec" login from the lowest l ogin shell."
• Previous message: Bill Verzal: "NFS cross-mount issue"
• Next in thread: Adams Kevin J: "Re: FS_Chdir audit record generated when not requested."
• Maybe reply: Adams Kevin J: "Re: FS_Chdir audit record generated when not requested."
• Messages sorted by: [ date ] [ thread ] [ subject ] [ author ] [ attachment ]

Hi, All

in setting up audit I defined a new class to contain only the events
I'm interested in. the problem is I'm getting more than I asked for,
specifically the FS_Chdir event. how can I be getting audit output
without including the event in any monitored class? I attach a copy of
my modified /etc/security/audit/config file. the change I've made is to
define the class "myclass" with the events I want to see. how can I be
getting output from the "general" class if no user is pointed to it? TIA

Jim Lane
Sr. Technical Consultant
Network Services
Toronto Hydro
office: (416)-542-2820
cell: (416)-896-8576

• application/octet-stream attachment: config

• Next message: Ignacio Vidal: "Re: SSHD 3004-004 You must "exec" login from the lowest l ogin shell."
• Previous message: Bill Verzal: "NFS cross-mount issue"
• Next in thread: Adams Kevin J: "Re: FS_Chdir audit record generated when not requested."
• Maybe reply: Adams Kevin J: "Re: FS_Chdir audit record generated when not requested."
• Messages sorted by: [ date ] [ thread ] [ subject ] [ author ] [ attachment ]

This archive was generated by hypermail 2.1.7 : Wed Apr 09 2008 - 22:16:35 EDT