From owner-freebsd-security@FreeBSD.ORG  Sun Jul 17 10:14:18 2011
Return-Path: <owner-freebsd-security@FreeBSD.ORG>
Delivered-To: freebsd-security@freebsd.org
Received: from mx1.freebsd.org (mx1.freebsd.org [IPv6:2001:4f8:fff6::34])
	by hub.freebsd.org (Postfix) with ESMTP id C3218106564A;
	Sun, 17 Jul 2011 10:14:18 +0000 (UTC)
	(envelope-from rwatson@FreeBSD.org)
Received: from cyrus.watson.org (cyrus.watson.org [65.122.17.42])
	by mx1.freebsd.org (Postfix) with ESMTP id 9EB1F8FC12;
	Sun, 17 Jul 2011 10:14:18 +0000 (UTC)
Received: from fledge.watson.org (fledge.watson.org [65.122.17.41])
	by cyrus.watson.org (Postfix) with ESMTPS id 533C846B32;
	Sun, 17 Jul 2011 06:14:18 -0400 (EDT)
Date: Sun, 17 Jul 2011 11:14:18 +0100 (BST)
From: Robert Watson <rwatson@FreeBSD.org>
X-X-Sender: robert@fledge.watson.org
To: Stacey Son <sson@FreeBSD.org>
In-Reply-To: <A945E553-0D06-4AF3-A855-B169F6D882D9@FreeBSD.org>
Message-ID: <alpine.BSF.2.00.1107171109181.75462@fledge.watson.org>
References: <1191160420.20110629145915@serebryakov.spb.ru>
	<A945E553-0D06-4AF3-A855-B169F6D882D9@FreeBSD.org>
User-Agent: Alpine 2.00 (BSF 1167 2008-08-23)
MIME-Version: 1.0
Content-Type: TEXT/PLAIN; charset=US-ASCII; format=flowed
Cc: freebsd-security@freebsd.org, Lev Serebryakov <lev@freebsd.org>
Subject: Re: OpenBSM: does somebody work on it?
X-BeenThere: freebsd-security@freebsd.org
X-Mailman-Version: 2.1.5
Precedence: list
List-Id: "Security issues \[members-only posting\]"
	<freebsd-security.freebsd.org>
List-Unsubscribe: <http://lists.freebsd.org/mailman/listinfo/freebsd-security>, 
	<mailto:freebsd-security-request@freebsd.org?subject=unsubscribe>
List-Archive: <http://lists.freebsd.org/pipermail/freebsd-security>
List-Post: <mailto:freebsd-security@freebsd.org>
List-Help: <mailto:freebsd-security-request@freebsd.org?subject=help>
List-Subscribe: <http://lists.freebsd.org/mailman/listinfo/freebsd-security>, 
	<mailto:freebsd-security-request@freebsd.org?subject=subscribe>
X-List-Received-Date: Sun, 17 Jul 2011 10:14:18 -0000


On Wed, 29 Jun 2011, Stacey Son wrote:

>>  I'm trying to use audit, and has some problems. First one is impossiblity 
>> to create custom event class, and second one I hit is with auditreduce(1)
>>
>>  auditreduce doesn't filter events by date (-b/-a/-d options with any 
>> arguments produces empty output), it doesn't merge files properly and 
>> doesn't pick up files automagically, as Solaris' one does. It doesn't have 
>> -C/-M/-O functionality of Solaris' one, too. So, proper merging of audit 
>> trial files seems to be impossible :(
>>
>>  I could try to fix & extend auditreduce(1), but does somebdy but me need 
>> it?
>>
>>  Does somebody use audit on FreeBSD on production systems?
>
> FYI, a better place to discuss this would be the trustedbsd-audit mailing 
> list.  There are quite of few people that use OpenBSM in production on 
> FreeBSD and Mac OS X that hang out on that list usually.

Hi Lev:

Just catching up on back e-mail, and bumped into this thread.  Did you file 
PRs for these bugs?  As Stacey mentions, the trustedbsd-audit mailing list is 
where most discussion of OpenBSM takes place.  It's generally pretty quiet, 
but there are quite a few people using audit in production, and I'm sure 
they'd appreciate bug reports (and even fixes!).

Robert