Hello,
I've just released a new version of the audit daemon. It can be downloaded
from
http://people.redhat.com/sgrubb/audit It will also be in rawhide
tomorrow. The Changelog is:
- Add --failed/success flags to aureport to select specific events for reports
- Add --summary to get totals of reported objects
- Add ability to force log rotation by sending sigusr1 to auditd
- Add -i flag to auditctl to ignore errors when reading rules from a file
- Reformat aureports so date & time are always given
- Add cron script for log rotation to docs
This release finishes up work on aureport. You can now select failed or
successful events for the reports. The default is both. There is a new
--summary option that totals whatever the main object of the report is. This
is helpful for getting a quick idea of what's happening on the machine.
Another feature is being able to force log rotation on demand. This works with
a cron script that can be installed for daily rotation if a site has that
kind of need. The cron script is not installed by default.
auditctl now has a new flag, -i, to ignore errors when reading rules from a
file.
Please let me know if there are any problems with this release.
Thanks,
-Steve