What does the hex number after arch= mean?
64bit seems to always be c000003e and 32bit seems to be 40000003, but
I'd feel a lot better setting up log monitoring if I knew what they
actually represented.
$ sudo auditctl -l
LIST_RULES: exit,always arch=3221225534 (0xc000003e) ...
Cheers,
peter
--
Peter Moody Google 1.650.253.7306
Security Engineer pgp:0xC3410038