Re: [Fed-Talk] Another BSM related question
Re: [Fed-Talk] Another BSM related question
- Subject: Re: [Fed-Talk] Another BSM related question
- From: Todd Heberlein <email@hidden>
- Date: Tue, 18 Aug 2009 14:14:57 -0700
Always glad to provide a good example :-) It's not clear what app
is making this request, though.
Look back for the program that process 2160 starts. If you are "old
school" you can open the audit trail in vi and search for the pattern
^subject.*,2160,
The audit record you will look for will either be a variant of exec()
or posix_spawn().
Todd
_______________________________________________
Do not post admin requests to the list. They will be ignored.
Fed-talk mailing list (email@hidden)
Help/Unsubscribe/Update your Subscription:
This email sent to email@hidden