SF.net SVN: logwatch:[294] trunk/scripts/services/audit

Revision: 294
          http://sourceforge.net/p/logwatch/code/294
Author:   opoplawski
Date:     2015-07-31 15:53:53 +0000 (Fri, 31 Jul 2015)
Log Message:
-----------
[audit] More audit ignores

Modified Paths:
--------------
    trunk/scripts/services/audit

Modified: trunk/scripts/services/audit
===================================================================
--- trunk/scripts/services/audit	2015-03-27 16:01:35 UTC (rev 293)
+++ trunk/scripts/services/audit	2015-07-31 15:53:53 UTC (rev 294)
@@ -127,6 +127,7 @@
         ( $ThisLine =~ /type=[0-9]+ audit\([0-9.]*:[0-9]*\): pid=[0-9]* uid=0 auid=[0-9]* ses=[0-9]*$/) or
         ( $ThisLine =~ /type=[0-9]+ audit\([0-9.]*:[0-9]*\): pid=[0-9]* uid=0 auid=[0-9]* ses=[0-9]* subj=.*res=success/) or
         ( $ThisLine =~ /type=[0-9]+ audit\([0-9.]*:[0-9]*\): pid=[0-9]* uid=0 old auid=[0-9]* new auid=[0-9]+ old ses=[0-9]* new ses=[0-9]+ res=1$/) or
+        ( $ThisLine =~ /type=[0-9]+ audit\([0-9.]*:[0-9]*\): pid=[0-9]* uid=0 subj=.* old-auid=[0-9]* auid=[0-9]+ old-ses=[0-9]* ses=[0-9]+ res=1$/) or
         ( $ThisLine =~ /type=[0-9]+ audit\([0-9.]*:[0-9]*\):  cwd=".*"/) or
         ( $ThisLine =~ /type=[0-9]+ audit\([0-9.]*:[0-9]*\): user/) or
         ( $ThisLine =~ /type=[0-9]+ audit\([0-9.]*:[0-9]*\): proctitle=/) or

This was sent by the SourceForge.net collaborative development platform, the world's largest Open Source development site.


------------------------------------------------------------------------------