openbsm / bsmtrace Goto Github PK

Hi,

We have a lot of filesystems defined in the configuration of bsmtrace on some systems and we have been running into bsmtrace crashing when some of the arrays run out of storage. Arrays should preferably be made to allocate memory dynamically.

We currently use this patch on our systems to get around this problem.

Hi,

Is there any documentation for this? Google doesn't turn up much.

For instance, I run bsmtrace with a finite state machine matching logins. What does it do when it matches an event? Does it output information, notices, etc.? When I run it in foreground mode, I see the event was matched & it gives some information about it (auid, duration, priority, etc.). But how do I use this? Maybe pipe it to logger to send it into syslog? Is there some built in logging or notification functionality in bsmtrace? In other words, how do I use this to monitor the events it matches?

Edit:
I found this: https://people.freebsd.org/~csjp/bsmtrace/bsmtrace.txt

Looks somewhat outdated.

Is there any way to set the output fields, format, etc?