Audit DAEMON_START DAEMON_STOP

jaypas · 08-24-2010, 03:31 PM

Hi, all,
When the audit daemon starts and stops, I see DAEMON_START DAEMON_STOP in the audit log. I don't see a rule in audit.rules about logging this event. So, I'm guessing that it's a rule that's built into the audit daemon. Can you confirm this?

Also, I've been looking for a explanation of the event types that the audit daemon logs, such as: USER_AUTH, USER_ACCT, CRED_ACQ. If you know of any docs that explain this, kindly send me the link.

Thanks,
Jaypas

unSpawn · 08-24-2010, 05:16 PM

Quote:

Originally Posted by jaypas

When the audit daemon starts and stops, I see DAEMON_START DAEMON_STOP in the audit log. (..) I'm guessing that it's a rule that's built into the audit daemon. Can you confirm this?

Yes. BTW, run 'ausearch -m' for a complete list of message types and to list all DAEMON_START occurrences try 'ausearch -m DAEMON_START'.

Quote:

Originally Posted by jaypas

explanation of the event types that the audit daemon logs, such as: USER_AUTH, USER_ACCT, CRED_ACQ.

For instance Understanding the Audit Logs and Generating Reports?

jaypas · 08-24-2010, 06:47 PM

Thanks for helping me.