I'm on the 2.4.5 version of the audit code.
Has anyone thought about or implemented a exclusionary message list,
such as:
ausearch -m ALL-avc,user_avc -ts today
I'd like to be able to search in this manner, where I exclude certain
message types.
I could write a patch, but if anyone has already done this I'd happily
use theirs.
The message type list is so long that it would be painful to have the
comma-delimited list of all but a couple.
Thx,
LCB
--
LC Bruzenak
magitekltd.com