Host Intrusion Detection System Administrator's Guide Release 3.1

Templates and Alerts
Changes to Log File Template
Appendix A
157
NOTE See Table B-1 in Appendix B for the definition of argv[10] through argv[32] which you
use to access specific alert information (for example, pid and ppid) without having to
parse the string alert fields above.
Limitations The template cannot distinguish between whether a file is created or truncated when
creat(2) is invoked.
argv[8] Details String User with uid <uid> <performed
action on the file> <full
pathname>(type=<type>,inode=<inod
e>, device<device>) when executing
<program>(type=<type>,inode=<inod
e>,device=<device>), invoked as
follows: <argv[0]> <argv[1]>..., as
process with pid <pid> and ppid
<ppid> and running with effective
uid=<euid> and with effective
gid=<egid>.
where <performed action on the file>
is set to one of the following:
opened for modification/truncation
deleted the file
deleted the directory
performed system call <number> on
the file
renamed the file
truncated the file
created the file (and overwrote any
existing file) named
Detailed alert
description
argv[9] Local Time Integer <secs> Local time in
number of seconds
since epoch when
file was modified
Table A-12 Append-Only File Being Modified Alert Properties (Continued)
Response
Program
Argument
Alert
Field
Alert Field
Type
Alert Value/Format Description