[Logwatch-devel] SF.net SVN: logwatch:[141] scripts/services/audit

[<opo...@us...>]

Revision: 141
          http://logwatch.svn.sourceforge.net/logwatch/?rev=141&view=rev
Author:   opoplawski
Date:     2013-05-22 15:30:08 +0000 (Wed, 22 May 2013)
Log Message:
-----------
Ignore more audit messages

Modified Paths:
--------------
    scripts/services/audit

Modified: scripts/services/audit
===================================================================
--- scripts/services/audit	2013-05-16 17:29:41 UTC (rev 140)
+++ scripts/services/audit	2013-05-22 15:30:08 UTC (rev 141)
@@ -122,6 +122,8 @@
         ( $ThisLine =~ /type=[0-9]+ audit\([0-9.]*:[0-9]*\): audit_enabled=[0-9]* old=[0-9]* auid=[0-9]* ses=[0-9]* subj=system_u:system_r:.*:s0 res=[0-9]*/) or
         ( $ThisLine =~ /type=[0-9]+ audit\([0-9.]*:[0-9]*\): auid=[0-9]* ses=[0-9]* subj=system_u:system_r:.*:s0 op=.* key=.* list=[0-9]* res=[0-9]*/) or
         ( $ThisLine =~ /type=[0-9]+ audit\([0-9.]*:[0-9]*\): pid=0 uid=0 auid=[0-9]* ses=[0-9]* subj=system_u:system_r:.*:s0 .* res=success/) or
+        ( $ThisLine =~ /type=[0-9]+ audit\([0-9.]*:[0-9]*\): pid=1 uid=0 auid=[0-9]* ses=[0-9]* subj=system_u:system_r:init_t:s0 .* res=success/) or
+        ( $ThisLine =~ /type=[0-9]+ audit\([0-9.]*:[0-9]*\): pid=[0-9]* uid=0 auid=[0-9]* ses=[0-9]*$/) or
         ( $ThisLine =~ /type=[0-9]+ audit\([0-9.]*:[0-9]*\):  cwd=".*"/) or
         ( $ThisLine =~ /type=[0-9]+ audit\([0-9.]*:[0-9]*\): user/) or
         ( $ThisLine =~ /audit_printk_skb: [0-9]* callbacks suppressed/) or

This was sent by the SourceForge.net collaborative development platform, the world's largest Open Source development site.