Re: How do I get complete list of audit event types

On Tuesday, April 08, 2014 10:53:40 AM Satish Chandra Kilaru wrote: > Hi > > I want to understand the logs in /var/log/audit/audit.log. Where can I get > complete list of audit event types ausearch -m help 2>&1 | tr ' ' '\n' | egrep '^[A-Z]' | egrep -v 'ALL|Valid' | sort > and what they mean? Each event type has some comment in the header files /usr/include/libaudit.h and /usr/include/linux/audit.h. There is also some documentation here: https://access.redhat.com/site/documentation/en-US/Red_Hat_Enterprise_Lin... And I want to think some other distros have docs as well. -Steve