Re: no logging of successful events?

Excellent! I had simply changed to the following, in a minimalistic approach: ---------------------------------------------------- -w /etc/auditd.conf -w /etc/audit.rules -a exit,always -S open -F success=0 -a exit,always -S rmdir -S unlink -S chmod -S fchmod -S chown -S fchown -S lchown -F success!=0 -a exit,always -S settimeofday -S setrlimit -S setdomainname -S sched_setparam -S sched_setscheduler -S acct -S reboot -S swapon ------------------------------------------------- Was grouping by failed, successful, and both. Did this due to reading that every audit rule is tested for every syscall, which...yeah, makes me want to group things. That being said, stig.rules is extensive; any warning on what the performance impact will be? Also, when looking for the newer builds on your site http://people.redhat.com/sgrubb/audit/ - I noticed "1.7 -> 1.8 Remote logging and finishing up IDS/IPS plugin." That would be wonderously fabulous, and I look forward to it. Any thoughts on whether it will be pulled into RHEL5, or whether I'd have to wait until RHEL6? Brian