On Tue, 20 May 2014 18:18:14 +0300 Ismail Yenigul <ismailyenigul(a)gmail.com&gt; wrote: > I have a scipt to correlate(for user friendly report) auditd 2.2 > version logs. It works on RedHat. > We have suse 11.4 server running audit 2.0.5 version . > > I could not see any major log format difference between two version. > I see that there is nametype=NORMAL field difference at the end of > each line for version 2.2. This is not related to auditd. This is a change in the kernel. Auditd just distributes events to disk and other applications. > Is there any other log format changes between two versions? There are likely differences in the kernels (and possibly user space apps). I have no idea what they are. -Steve

On Tue, 2014-05-20 at 18:35 +0300, Ismail Yenigul wrote: > Thanks for prompt reply. > > > > The kernel versions are very close. Not really. RHEL kernels are vastly different than the old 2.6.32 kernel. In this case, the RHEL kernel gives some very very new information which didn't exist back in 2.6.37. Aka the 2.6.32 rhel kernel is 'newer' than the 2.6.37 suse kernel. Does that make sense? > Redhat: 2.6.32-431.11.2.el6.x86_64 > > Suse: 2.6.37.1-1.2-desktop > > > I have a scipt to correlate(for user friendly report) auditd > 2.2 > > version logs. It works on RedHat. > > We have suse 11.4 server running audit 2.0.5 version . > > > > I could not see any major log format difference between two > version. > > I see that there is nametype=NORMAL field difference at the > end of > > each line for version 2.2. This is a new key=value pair which tells your something about this particular name record. Imagine you called rename() and placed on file on top of another existing file. In old kernels you'd end up with about 4 different audit names. Old parent dir, new parent dir, old file moving, new file being unlink() because of the rename() on top of it. This field is supposed to help you figure out which of these audit names goes with which part of the syscall. Make sense?