On Thursday 16 August 2007 15:36:53 John Dennis wrote: Not exactly. There is a listing of every event type in the headers as well as when you just type "ausearch -m". But what's in each record is not in a released document right now. The interpretation of that field can be found in the audit parsing spec: http://people.redhat.com/sgrubb/audit/audit-parse.txt It is a gentleman's agreement. I have personally reviewed and fixed all audit messages to make sure they are uniform except the selinux avcs. Anytime I suggest normalizing them, they get upset and say it will break existing tools. So, I have no way of making avcs follow a schema unless they want to change it. As for userspace, I enforce the gentlemen's agreement by the logging functions in libaudit. All that's required in an audit event is: Date and time of event, type of event, user associated with the event, subject identity, resources involved. outcome, Sensitivity labels of subjects and objects. Anything else is icing on the cake. -Steve