On Thu, 21 Feb 2008, sam wrote:
i am using OpenBSM on System with jails
part of praudit output / action write file in jail
--------------------------------------------------
header,176,10,open(2) - write,creat,trunc,0,Thu Feb 21 13:45:06 2008, + 501
msec,argument,3,0x81ed,mode,argument,2,0x601,flags,path,//site/svn/dev.lineage2.dom/pamm/hooks/post-commit,attribute,755,www,www,88,800911,3234053,subject,lynx,root,wheel,root,wheel,44680,44668,56876,10.15.1.116,return,success,4,trailer,176,
--------------------------------------------------
please add jail-identification in output (cat /dev/auditpipe | praudit -lp)
Vladimir,
I believe Christian has plans to use the Solaris "zone" BSM token to this end,
as well as plans to enhance our support for hostid header fields so that when
audit trails are aggregated from many sources, they can be processed with
awareness of which source they came from. I've added him to the CC line, and
he may be able to expand on this.
Robert N M Watson
Computer Laboratory
University of Cambridge
_______________________________________________
freebsd-hackers@freebsd.org mailing list
http://lists.freebsd.org/mailman/listinfo/freebsd-hackers
To unsubscribe, send any mail to "[EMAIL PROTECTED]"
