Re: ausearch on aggregation - syscall difference
On Fri, 2008-10-24 at 13:16 -0400, Steve Grubb wrote:
On Friday 24 October 2008 13:08:41 LC Bruzenak wrote:
> Note that the syscall is listed differently.
Interesting.
> This is using the 1.7.7 code (on F9), I have not yet moved over to 1.7.8
> in case it may be fixed there.
Nope...nothing was changed there to fix it. This is the first I'd heard of the
problem..Can you show me the raw record?
ausearch -ts today -a 10038 --raw
Thanks,
-Steve
[root@dell1 ~]# ausyscall 102
getuid
[root@dell1 ~]# ausyscall i386 102
socketcall
--
LC (Lenny) Bruzenak
lenny(a)magitekltd.com