Hi, I was wondering if anyone has had the problem I'm having or knows how to fix it. I need to audit one of our servers at work. I turned on BSM auditing and modified the audit_control file to only flag the "lo" class(login/outs) then I rebooted. I viewed the log BSM created and it shows a whole bunch of "fcntl" headers. When I looked up "fcntl" in the audit_event file its class showed "fm"(file mod). There are other classes that are showing up in the logs and I don't know why. I told it to log only "lo" but its doing that plus more. Any help would be appreciated, thanks.
Rob