Post #3285853

So I'm poking around with #AuditD, also swearing mildly at 'msg=' being used twice on a line which breaks trivial parsing, when I realised I haven't seen a *good* deep dive on on it for a while. The Red Hat docs [1] cover the basics, while the GH linux-audit repos cover the tech details, but no recent presentations I wonder if @corbet could persuade someone to write an article for #LWN? [1] https://docs.redhat.com/en/documentation/red_hat_enterprise_linux/10/html/risk_reduction_and_recovery_operations/auditing-the-system