Displaying 1 result from an estimated 1 matches for "classmask".
Did you mean:
class_mask
2011 Jun 26
1
How to add new audit class?
...(new process image is
security-sensible, not new process itself) and occurred too often
and create noise.
connect()/accept() from "nt", but not setsockopt(), for the same
reasons.
And so on.
How should I create new system class? What need to be putted into
"classmask" in audit_class(5)? How should I edit audit_event(5) file,
as it seems, that one event could belong only to one class, and I
don't want to remove these events from their natural classes.
--
// Black Lion AKA Lev Serebryakov <lev@FreeBSD.org>