Audit questions.

From: Jerome F Trimbach/DXST/74014/346 <jt42_at_naic.wpafb.af.mil>
Date: Thu, 03 Dec 1998 09:14:52 -0500

Hi,
I've got a couple of questions about using the audit subsystem in DU4.0C. I'd
like to know how I can audit failed rm's - I am auditing the system calls rmdir
and unlink already. Also, is there a way to mask out failed open events based
on the reason for failure (e.g. file nonexistent, permission denied, etc.)

Thanks.
Received on Thu Dec 03 1998 - 14:22:04 NZDT