From: Adams Kevin J (kevin.adams@PHS.COM)
Date: Fri Feb 07 2003 - 14:58:25 EST
Some things will generate events without asking for them.
It's just the way it is. This has been discussed several times in the past.
You can use filtering to ignore the events you don't want.
Kevin Adams
-----Original Message-----
From: Jim Lane [mailto:JLane@TORONTOHYDRO.COM]
Sent: Friday, February 07, 2003 8:08 AM
To: aix-l@Princeton.EDU
Subject: [aix-l] FS_Chdir audit record generated when not requested.
Hi, All
in setting up audit I defined a new class to contain only the events
I'm interested in. the problem is I'm getting more than I asked for,
specifically the FS_Chdir event. how can I be getting audit output
without including the event in any monitored class? I attach a copy of
my modified /etc/security/audit/config file. the change I've made is to
define the class "myclass" with the events I want to see. how can I be
getting output from the "general" class if no user is pointed to it? TIA
Jim Lane
Sr. Technical Consultant
Network Services
Toronto Hydro
office: (416)-542-2820
cell: (416)-896-8576
This electronic message transmission, including any attachments, contains information from PacifiCare Health Systems Inc. which may be confidential or privileged. The information is intended to be for the use of the individual or entity named above. If you are not the intended recipient, be aware that any disclosure, copying, distribution or use of the contents of this information is prohibited.
If you have received this electronic transmission in error, please notify the sender immediately by a "reply to sender only" message and destroy all electronic and hard copies of the communication, including attachments.
This archive was generated by hypermail 2.1.7 : Wed Apr 09 2008 - 22:16:35 EDT