Steve, would you mind giving me a little more gu= idance on this?

Is there anything more specific you can sugges= t?=C2=A0

I don't want to provide a false sense of securit= y to my IA people.

-----------= ---------------
Warron French

---------- Forwarded message ----------
F= rom: warron.french <= warron.french@gmail.com><= /span>
Date: Tue, Oct 11, 2016 at 2:58 PM
Subject: Syscalls to useTo: linux-audit@redhat.com

I apologize, but I am n= ot sure how to go about determining the appropriate syscalls to use for var= ious audit goals.

I know that recently I learned to use the au= syscall --dump command to list the ausyscalls; but apparently I mis-underst= ood/interpreted the purpose of 1 or 2 of the syscalls and had to be correct= ed (thanks Steve).

Anyway, my organization has a goal to audit= several things; of which I know how to manage most, for examples:

<= ol>

File & Object

Creation (Success/Failure)=C2=A0= =C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0= =C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0 |=C2=A0 w

Access (Success/Failure)=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0= =C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2= =A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0= =C2=A0=C2=A0=C2=A0 |=C2=A0 r

Deletion (Success/Failure)=C2=A0=C2= =A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0= =C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2= =A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0 |=C2=A0 w

<= span class=3D"m_3592792348086022154m_-102827351259328000gmail-">Content Mod= ification (Success/Failure)=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2= =A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0 |=C2=A0 a

= Permission Modification (Success/Failure)=C2=A0=C2=A0=C2=A0=C2=A0=C2= =A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0 |=C2=A0 a

Ownership Mod= ification (Success/Failure)=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0= =C2=A0=C2=A0=C2=A0=C2=A0 |=C2=A0 a

For these I would hav= e used a watch (-w) rule and set the -p flags to r, w = or a as shown above.=C2=A0 From what I understand though, correct me= if I am wrong Steve, we should be getting away from the watch rules and mo= ve towards Syscalls and using -F path=3D/path/to/file, or
-F p= ath=3D/path/to/several_files/=C2=A0=C2=A0 -- is this correct, both for = RHEL6 and RHEL7?

Also, I need to audit (Success/Failure) for = the following sort of things:

Auth= entications

Log= ons

Logoffs

Writes/downloads to external devices/media

Uploads from external devices/media (such as Dv= D, thumbdrive, etc)

User & Group events

User:=C2=A0 Creation, deleti= on, Modification, suspending/locking

Group/Role:=C2=A0 Creation, deletion, modification

Use of Privileged/Special Rights events (such as sudo, su, etc..)

Printing to a print-d= evice

Printing to a file

Thanks in advance for any steering someone could prov= ide to get me moving in the correct direction.

-----------------------= ---
Warron French