From owner-freebsd-hackers@freebsd.org  Thu Oct  6 16:59:59 2016
Return-Path: <owner-freebsd-hackers@freebsd.org>
Delivered-To: freebsd-hackers@mailman.ysv.freebsd.org
Received: from mx1.freebsd.org (mx1.freebsd.org
 [IPv6:2001:1900:2254:206a::19:1])
 by mailman.ysv.freebsd.org (Postfix) with ESMTP id 64846AF6D63;
 Thu,  6 Oct 2016 16:59:59 +0000 (UTC)
 (envelope-from mokhi64@gmail.com)
Received: from mail-wm0-x231.google.com (mail-wm0-x231.google.com
 [IPv6:2a00:1450:400c:c09::231])
 (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits))
 (Client CN "smtp.gmail.com",
 Issuer "Google Internet Authority G2" (verified OK))
 by mx1.freebsd.org (Postfix) with ESMTPS id 00074EEA;
 Thu,  6 Oct 2016 16:59:58 +0000 (UTC)
 (envelope-from mokhi64@gmail.com)
Received: by mail-wm0-x231.google.com with SMTP id i130so17107086wmg.1;
 Thu, 06 Oct 2016 09:59:58 -0700 (PDT)
DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20120113;
 h=mime-version:from:date:message-id:subject:to;
 bh=9bK84vYO3YSPpFpJe0K0/4kDhzeDLLQYL6uZFSgft5s=;
 b=bAb9+3B5Z1YIcr5lVn/JiQ4IJDqKAwhRNrzqrTWVqe5PXWwOtdRxArLRNbHrpXpcdW
 X5Ag149VR8Jxd4jQXS4G6L36S96/EyMj453yakQnKpZi91fBQU2vPVP2N6F55Rq80hof
 5GOvxqa4hE4WtoYtuEIUSK8AhV+AyaTR0APOC2ii9pnp69FQnkhgxQXQ51s7tstEntru
 dqSbjyEpis6ndBOQ67PyENvPst7fwespqNLe/be3omHzb4KTKAKpa4LXcgeUnyHe9Uaj
 nUoEmdrLcow/nkLX1xGpgg74JlHnyVogeeaxRBIAEHdDuBx7WJaSfMg/+MT6Et9PIxMS
 mWiA==
X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed;
 d=1e100.net; s=20130820;
 h=x-gm-message-state:mime-version:from:date:message-id:subject:to;
 bh=9bK84vYO3YSPpFpJe0K0/4kDhzeDLLQYL6uZFSgft5s=;
 b=Ngr945BvzvayA5cOnEEYR10x0gOArrsxYi333yxC8gU323KWYcvY7vlHgjyDCjlBAL
 WGpWNqlyh2ASz+iRxHP2qrmDDzAdZ2DD7Q61P3g/p189tiKKpMQJEiHnjvQxDWkJrMwI
 FC3TH34d+NY+NCuNI+Glj/tRHs7Dly5YP2VANkbEK82UMa3tfPF8poptZbuJUDpN8wWD
 vZhGCDjxdWVY47MyQM0O/xIhtCJ12i5HtqLuZOYvfVX4d6pUhLifQ7mP1eyZBR+tJAkT
 H7iWzFO5JBu93RVk0WTHJi5Acas3Zjy/oON6lYofnZth7X+e8eKPxOZNWjdhAJkRw0jc
 qi8Q==
X-Gm-Message-State: AA6/9Rl8gZoBOYdfTfW9lMgO9kmT00fmyqKw6nHPpk/vKa/Axew4vN+QrHo/6yAB9KJBDDxo7892J0nDCNanDQ==
X-Received: by 10.28.220.212 with SMTP id t203mr16312156wmg.102.1475773197251; 
 Thu, 06 Oct 2016 09:59:57 -0700 (PDT)
MIME-Version: 1.0
Received: by 10.28.166.204 with HTTP; Thu, 6 Oct 2016 09:59:56 -0700 (PDT)
From: mokhi <mokhi64@gmail.com>
Date: Thu, 6 Oct 2016 20:29:56 +0330
Message-ID: <CAByVWPVhrb78=tgHBKf578MO2n3xWQnGeksV9NQtAi+LeKmiCA@mail.gmail.com>
Subject: Using Audit Framework and praudit
To: freebsd-hackers@freebsd.org, hackers@freebsd.org
Content-Type: text/plain; charset=UTF-8
X-BeenThere: freebsd-hackers@freebsd.org
X-Mailman-Version: 2.1.23
Precedence: list
List-Id: Technical Discussions relating to FreeBSD
 <freebsd-hackers.freebsd.org>
List-Unsubscribe: <https://lists.freebsd.org/mailman/options/freebsd-hackers>, 
 <mailto:freebsd-hackers-request@freebsd.org?subject=unsubscribe>
List-Archive: <http://lists.freebsd.org/pipermail/freebsd-hackers/>
List-Post: <mailto:freebsd-hackers@freebsd.org>
List-Help: <mailto:freebsd-hackers-request@freebsd.org?subject=help>
List-Subscribe: <https://lists.freebsd.org/mailman/listinfo/freebsd-hackers>, 
 <mailto:freebsd-hackers-request@freebsd.org?subject=subscribe>
X-List-Received-Date: Thu, 06 Oct 2016 16:59:59 -0000

Hi guys.
For using "The audit framework", should I rebuild my kernel to use
"praudit" to log exec or syscall events ?
I used the way that handbook says to use praudit, but it only shows me
logs on authentications with "su" and stop/starting "auditd" service,
and there's no any other logs.
Any ideas what other things should i do ?

Best wishes, Mokhi.