Re: filtering by auid
> auditctl -a user,never -F loginuid!=$LOGINUID
> auditctl -a user,always -F loginuid=$LOGINUID
>
With audit 0.9.11 and kernel.audit.64 on a pSeries system, it just prints
out the usage info (no other info about what it doesn't like) if I try
running any of the following commands:
auditctl -a user,never -F loginuid=500
auditctl -a user,never -F auid=500
auditctl -a user,always -F loginuid=500
auditctl -a user,always -F auid=500
Attachments:
- attachment.html (text/html — 573 bytes)