--- a/scripts/services/audit 2022/01/22 17:22:03 +++ b/scripts/services/audit 2022/01/22 17:35:34 @@ -134,10 +134,13 @@ ( $ThisLine =~ /type=[0-9]+ audit\([0-9.]*:[0-9]*\): table=/) or ( $ThisLine =~ /audit_printk_skb: [0-9]* callbacks suppressed/) or ( $ThisLine =~ /item=[0-9] name="\S*" inode=[0-9]+ dev=\S* mode=[0-9]* ouid=[0-9]* ogid=[0-9]* rdev=[0-9:]* obj=\S*/) or - ( $ThisLine =~ /^auditctl(?:\[[0-9]+\])?: No rules$/ ) + ( $ThisLine =~ /^auditctl(?:\[[0-9]+\])?: No rules$/ ) or + ( $ThisLine =~ /No plugins found, not dispatching events/ ) ) { # Ignore these entries - } elsif ( $ThisLine =~ /audit\([0-9]{10}.[0-9]{3}:[0-9]\): initialized$/) { + } elsif (( $ThisLine =~ /audit\([0-9]{10}.[0-9]{3}:[0-9]\): initialized$/ ) or + ( $ThisLine =~ /audit\([0-9]{10}.[0-9]{3}:[0-9]\): state=initialized / ) + ) { $NumberOfInits++; } elsif ( $ThisLine =~ /Init complete, audit pid set to: [0-9]+/) { $NumberOfDStartsPid++;