You can not select more than 25 topics
Topics must start with a letter or number, can include dashes ('-') and can be up to 35 characters long.
20 lines
989 B
20 lines
989 B
1 year ago
|
--- a/scripts/services/audit 2022/01/22 17:22:03
|
||
|
|
+++ b/scripts/services/audit 2022/01/22 17:35:34
|
||
|
|
@@ -134,10 +134,13 @@
|
||
|
|
( $ThisLine =~ /type=[0-9]+ audit\([0-9.]*:[0-9]*\): table=/) or
|
||
|
|
( $ThisLine =~ /audit_printk_skb: [0-9]* callbacks suppressed/) or
|
||
|
|
( $ThisLine =~ /item=[0-9] name="\S*" inode=[0-9]+ dev=\S* mode=[0-9]* ouid=[0-9]* ogid=[0-9]* rdev=[0-9:]* obj=\S*/) or
|
||
|
|
- ( $ThisLine =~ /^auditctl(?:\[[0-9]+\])?: No rules$/ )
|
||
|
|
+ ( $ThisLine =~ /^auditctl(?:\[[0-9]+\])?: No rules$/ ) or
|
||
|
|
+ ( $ThisLine =~ /No plugins found, not dispatching events/ )
|
||
|
|
) {
|
||
|
|
# Ignore these entries
|
||
|
|
- } elsif ( $ThisLine =~ /audit\([0-9]{10}.[0-9]{3}:[0-9]\): initialized$/) {
|
||
|
|
+ } elsif (( $ThisLine =~ /audit\([0-9]{10}.[0-9]{3}:[0-9]\): initialized$/ ) or
|
||
|
|
+ ( $ThisLine =~ /audit\([0-9]{10}.[0-9]{3}:[0-9]\): state=initialized / )
|
||
|
|
+ ) {
|
||
|
|
$NumberOfInits++;
|
||
|
|
} elsif ( $ThisLine =~ /Init complete, audit pid set to: [0-9]+/) {
|
||
|
|
$NumberOfDStartsPid++;
|
||
|
|
|