Re: Add a plugin
On Wednesday 23 December 2009 02:58:13 am Adan wrote:
Right now , I want to add it to the audit project to make it
response to
the event at the same time. What should I do?
You need to take this file:
https://fedorahosted.org/audit/browser/trunk/contrib/plugin/audisp-exampl...
Fill it out with the path to your executable and set active to yes.
Then install it to /etc/audisp/plugins.d/ and restart the audit daemon.
You should be able to do a "ps -ef" and see your plugin is running.
The location that your plugin installs to should probably be /sbin
and if your plugin needs a configuration file, it could be located
anywhere inside /etc. I generally choose /etc/audisp for SE Linux
reasons, but you can put it anywhere.
-Steve