Re: Events per System Call
On Monday, August 16, 2010 08:49:48 pm Basim Baig wrote:
If i am taking my data stream through the af_unix socket built-in
plugin
then will i get the audit_eoe event?
For an audispd plugin, you would need to set the format parameter to binary.
See the sample conf file:
https://fedorahosted.org/audit/browser/trunk/contrib/plugin/audisp-exampl...
or the audisp man page for discussion on each parameter's values.
Do i have to setup some special rule to get this event or is it there
by default
in the af_unix plugin stream?
The default is to turn things into strings so that they can be used by the
auparse library. But the binary setting means you are willing to follow all
the rules and do it yourself however painful that may be. :) I think they
are here:
http://people.redhat.com/sgrubb/audit/audit-rt-events.txt
You can probably use the same code as this:
https://fedorahosted.org/audit/browser/trunk/contrib/skeleton.c
to write your plugin.
-Steve