Re: Audit Parsing Library Requirements
On Friday 10 March 2006 15:38, Steve Grubb wrote:
For example, root change bob's
account password. search for uid=bob will hit on the password change event
since bob's account is what's being manipulated.
Actually, this is bad example since I don't think it happens for this message.
There's only 1 or 2 messages that do this and I don't remember what they are
other than user space. But we do favor the uid later in the message under the
current scheme.
-Steve