1

I am writing a converter which takes Linux Audit logs as input. I tried to find the most recent dictionary file where all the valid names of the fields are defined.

I've found such a file[1] but the main website[2] says:

Specs

The specifications have moved to github. The following will be left in place for a while and then removed.

I cannot find these information on the GitHub Wiki[3] of the Linux Audit project.

Is the file[1] still the most recent and valid source of information?

Links:

  1. https://people.redhat.com/sgrubb/audit/field-dictionary.txt
  2. https://people.redhat.com/sgrubb/audit
  3. https://github.com/linux-audit/audit-documentation/wiki
Improve this question

1 Answer 1

Reset to default
2

From your github link, follow "Audit Event Parsing Library" which has a link the the dictionary at https://github.com/linux-audit/audit-documentation/blob/master/specs/fields/field-dictionary.csv

The raw CSV version is at

https://raw.githubusercontent.com/linux-audit/audit-documentation/master/specs/fields/field-dictionary.csv

Improve this answer

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .