\n\n"; my @c = split("\n",$w); $_c = scalar(@c)+1; # Yeah, opening the log every time from the beginning is overhead, but timestamps are mixed up from ausearch # they don't always appear cronologically, so we must search all the file. open(LOG, ") {if ($log eq $c[$x]."\n") {$ignore = 1; last;} else {$ignore = 0;}}} close (LOG); print LOG_NEW $w; return if $ignore == 1; print $w;} $whole_line = ''; $discard = 1; # discards the first one while () {# This is the delimiter if (/^----/) {do_alert($whole_line) unless $discard; $whole_line = ''; $discard = 0;} else {# Personally I add the exception of all root execve() calls so that it won't show normal system calls. # However, if you want to get a really strict environment, you can audit all regular root commands on your system and for your shell login # and then create exceptions for those commands through regular expressions like below.
\n n"; yangu @ c = kupasuliwa("\n",$katika); $_c = scalar(@ C)+1; # Yeah, kufungua logi kila wakati tangu mwanzo ni Rudia, lakini timestamps ni mchanganyiko kutoka ausearch # hawana daima kuonekana cronologically, hivyo lazima kutafuta faili wote. kufungua(Ingia, ") {kama ($logi EQ $ c[$x]."\n") {$ignore = 1; mwisho;} mwingine {kupuuza =nore = 0;}}} karibu (Ingia); magazeti LOG_NEW $ w; kurudi kama $ kupuuza == 1; magazeti $ w;} $whole_line =''; $kuondokana na = 1; # kutupwa moja ya kwanza () {# Hii ni delimiter (/^ ---- /) {do_alert($whole_line) unless $discard; $whole_line =''; $discard = 0;} mwingine {# Mimi binafsi kuongeza ubaguzi wa execve wote mizizi() wito ili kwamba itakuwa si kuonyesha wito wa mfumo wa kawaida. # Hata hivyo, kama unataka kupata mazingira ya kweli kali, wewe unaweza ukaguzi amri zote mizizi ya mara kwa mara juu ya mfumo na kwa ajili ya shell login yako # na kisha kuunda misamaha kwa amri hizo kupitia kwa njia za mara kwa mara kama hapo chini.