Red Hat Enterprise Linux 5 Administration Unleashed

512CHAPTER 25Linux Auditing SystemmsgtypeMessage type number. Should only be used on the exclude filter list.persOS Personality Number.archdevmajordevminorinodeexitsuccessa0, a1, a2, a3keyobj_userobj_roleobj_typeProcessor architecture of the system call. Specify the exact architecturesuch as i686 (can be retrieved from the uname -m command) or b32 touse the 32-bit system call table or b64 to use the 64-bit system call table.Device Major Number.Device Minor Number.Inode Number.Exit value from system call.Success value of system call. Use 1 for true/yes and 0 for false/no.First four arguments to the system call, respectively. Only numericalvalues can be used.Set a filter key with which to tag audit log message for the event. SeeListing 25.2 and Listing 25.3 for examples. Similar to the -k option usedwhen adding watches. Refer to “Writing Audit Rules and Watches” fordetails about the -k option.SELinux user for the resource.SELinux role for the resource.SELinux type for the resource.