Host Intrusion Detection System Administrator's Guide Release 3.1

Templates and Alerts
Modification of Another User’s File Template
Appendix A
170
NOTE See Table B-1 in Appendix B for the definition of argv[10] through argv[32] which you
can use to access specific alert information (for example, pid and ppid) without having
to parse the string alert fields.
Limitations None
argv[8] Details String User with uid <uid> <performed
action on the file> <full
pathname>(type=<type>,inode=<i
node>, device<device) when
executing
<program>(type=<type>,inode=<i
node>,device=<device>), invoked
as follows: <argv[0]>
<argv[1]>..., as process with pid
<pid> and ppid <ppid> and running
with effective uid=<euid> and with
effective gid=<egid>.
where <performed action on the file> is
set to one of the following:
changed the owner of
changed the permission of
opened for modification/truncation
renamed the file
created the file (and overwrote any
existing file) named
truncated the file
deleted the file
deleted the directory
performed system call <number> on the
file
Detailed alert
description
argv[9] Local Time Integer <secs> Local time in
number of seconds
since epoch when
a world-writable
file was created
Table A-18 Non-Owned File Being Modified Alert Properties (Continued)
Response
Program
Argument
Alert
Field
Alert
Field Type
Alert Value/Format Description