The audit package contains the user-spaceutilities for creating audit rules, as well as forstoring and searching the audit records generateby the audit subsystem in the Linux 2.6 kernel. It also has a basic Intrusion Detection plugin based on audit events capable of IDMEF alerting using prelude.License: GNU General Public License (GPL)Changes:
Improved support for kernel audit system immutable mode. A limit on restarts of crashed audispd plugins. Improved handling of audit events from PAM. Improved support for session association in ausearch. This release introduces the aulast command, which is similar to the utmp-based "last" command.