auditctl's rules, I want to send those matched records to my Python script for further analysis.
These are the involved files:
type=PATH msg=audit(1451011319.268:533): ... type=CWD msg=audit(1451011319.268:533): cwd=”/home/root” type=SYSCALL msg=audit(1451011319.268.230:533): ... key=(null)
/etc/audisp/audispd.confis, as follows,
q_depth = 80 overflow_action = ignore priority_boost = 4 max_restarts = 10 name_format = HOSTNAME #name = mydomain
audispdplugin configuration file in
active = yes direction = out path = /usr/bin/python type = always # two args, one is my Python script, the other is the log file args = /var/t/h.py /var/log/audit.log format = string
My h.py is, as follows,
# -*- coding: utf-8 -*- import sys print sys.argv ...
However, my Python script can't get any records from
I don't know where is wrong, please give me a hand!