Re: Should open syscall records occur without a path record?
On Monday 23 July 2007 09:09:22 John D. Ramsdell wrote:
Is it appropriate for audit analysis programs to assume a PATH
record
will be available with every open syscall event? I cannot see how to
do my analysis without the PATH record.
There should be a PATH record for every open. Have you verified the logs or
trusting ausearch? (Trying to figure out if there is a kernel problem or
search problem.) As a first step, I'd construct some kind of regex command to
see if you can verify that the kernel is recording PATH records for all
opens. You may need to narrow the test case so that there aren't as many
records to dig through.
-Steve