The audit package contains the user-spaceutilities for creating audit rules, as well as forstoring and searching the audit records generateby the audit subsystem in the Linux 2.6 kernel. It also has a basic Intrusion Detection plugin based on audit events capable of IDMEF alerting using prelude.License: GNU General Public License (GPL)Changes:
Serialization of records was fixed in ausearch.Audit of TTY input is now fully supported. aulastcan now provide a search command to retrieverecords of a particular login session. The accountmodification report in aureport now shows theaccount that was modified.