Robert Watson wrote:>
> Dear all,
>
> I've just comitted a fix to syscalls.master and regenerated the
> remaining system call files, which should correct the auditctl:
> Invalid Argument error being returned by auditd. In short order, this
> fix should be on the cvsup mirrors -- please let me know if it
> resolves the problem you were experiencing.
Hi,
After installing and running auditd I don't see any log files for auditd:
daemon# ls -l /var/audit/
total 0
-r--r----- 1 root audit 0 Sep 18 14:23 20060918052316.20060918060339
-r--r----- 1 root audit 0 Sep 18 15:03 20060918060339.not_terminated
I have custom /etc/security/audit_control and audit_user files.
daemon# more /etc/security/audit_control
#
# $P4: //depot/projects/trustedbsd/openbsm/etc/audit_control#3 $
# $FreeBSD: src/contrib/openbsm/etc/audit_control,v 1.2.2.1 2006/09/02
10:46:00 rwatson Exp $
#
dir:/var/audit
flags:all
minfree:20
naflags:lo
#
# $P4: //depot/projects/trustedbsd/openbsm/etc/audit_user#3 $
# $FreeBSD: src/contrib/openbsm/etc/audit_user,v 1.2.2.1 2006/09/02
10:46:00 rwatson Exp $
#
#root:lo:no
root:all:no
I'm bit confused here I thought auditd should log all activities, but I
don't see any log files.
Am I doing something wrong here or my understanding regarding auditd is
wrong?
thanks in advance,
Ganbold
>
> Thanks,
>
> Robert N M Watson
> Computer Laboratory
> University of Cambridge
> _______________________________________________
> freebsd-stable@freebsd.org mailing list
> http://lists.freebsd.org/mailman/listinfo/freebsd-stable
> To unsubscribe, send any mail to
"freebsd-stable-unsubscribe@freebsd.org"
>
>
>