How do I audit:
1. Print to file, and
2. Print to device,
FROM
A. terminal session or cli, and
B. GUI / Firefox (for example)?
Is there an ausyscall that can be monitored in audit.rules?
[SOLVED] - audit rules for printing
- warron.french
- Posts: 616
- Joined: 2014/03/27 20:21:58
[SOLVED] - audit rules for printing
Last edited by warron.french on 2018/05/02 18:45:40, edited 1 time in total.
Thanks,
War
War
- warron.french
- Posts: 616
- Joined: 2014/03/27 20:21:58
Re: audit rules for printing
I learned from Steve Grubb that cupsd is hardwired for audting already.
You can confirm this by:
ldd /usr/sbin/cups | grep audit
libaudit.so.1 => /lib64/libaudit.so.1 (0x00007f04f1cfa000)
What this means is you don't have to put in an explicit rule into the /etc/audit/rules.d/audit.rules file on redhat 7; or for redhat 6 machines into the /etc/audit/audit.rules file.
You can confirm this by:
ldd /usr/sbin/cups | grep audit
libaudit.so.1 => /lib64/libaudit.so.1 (0x00007f04f1cfa000)
What this means is you don't have to put in an explicit rule into the /etc/audit/rules.d/audit.rules file on redhat 7; or for redhat 6 machines into the /etc/audit/audit.rules file.
Thanks,
War
War