Filter - Linux-audit - Linux-Audit List Archives

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

2011

2010

2009

2008

2007

2006

2005

2004

Filter

[patch RFC]: userspace crypto...

Filter User Logs

List Quest

Wednesday, 4 August 2010 Wed, 4 Aug '10

5:25 a.m.

Hi; I need filter logs to terminal name(if tty/terminal equal none, write to audit.log). Example: -a entry,always -S execve -F tty!=none But, no use tty in filter parameter list. How this? Thank You Best Regards

Attachments:

attachment.html (text/html — 248 bytes)

Reply

Show replies by date

Steve Grubb

Wednesday, 4 August Wed, 4 Aug

8:31 a.m.

On Wednesday, August 04, 2010 06:25:59 am List Quest wrote:

I need filter logs to terminal name(if tty/terminal equal none, write to audit.log). Example: -a entry,always -S execve -F tty!=none But, no use tty in filter parameter list. How this?

The kernel does not filter on tty because it is a text string and not a number. So, all events would get recorded. you would then run a search against the logs to find the records you want. That's the way it is unless someone submits patches. ;) -Steve

Reply

5253

days inactive

5253

days old

linux-audit@lists.linux-audit.osci.io

Manage subscription

1 comments

2 participants

tags (0)

participants (2)

List Quest
Steve Grubb