search

seclab-stonybrook / eaudit

eAudit suite for recording provenance-related system calls on Linux
GNU General Public License v3.0
9 stars 3 forks source link

After running ./ecapd and ./eaudit , there was no output from the backend #4

Open KSGJ-CLOUD opened 6 months ago

KSGJ-CLOUD commented 6 months ago

hello，May I ask a question about operation ./ecapd and ./eaudit, there was no output from the backend image

profsekar commented 6 months ago

You should look at the documentation carefully. It contains information about how to specify the file.

KSGJ-CLOUD commented 6 months ago

When I run ./eaudit -P output.log，but ouput.log is empty. image

profsekar commented 6 months ago

It is not a commercial or open-source product, but a prototype written for a research minded audience. Perhaps things are not spelt out as explicitly as they should be. But there is enough documentation, and it all works well.

-- Sekar

On Tue, Apr 16, 2024 at 12:07 AM KSGJ-CLOUD @.***> wrote:

When I run ./eaudit -P output.log，but ouput.log is empty. image.png (view on web) https://github.com/seclab-stonybrook/eaudit/assets/71766358/0badb925-7897-41fa-b6e3-278c28555b05

— Reply to this email directly, view it on GitHub https://github.com/seclab-stonybrook/eaudit/issues/4#issuecomment-2058190054, or unsubscribe https://github.com/notifications/unsubscribe-auth/AEGU44PNDQ43WIRKE7BCTGDY5SPYNAVCNFSM6AAAAABGG7D2PKVHI2DSMVQWIX3LMV43OSLTON2WKQ3PNVWWK3TUHMZDANJYGE4TAMBVGQ . You are receiving this because you commented.Message ID: @.***>

KSGJ-CLOUD commented 6 months ago

Thank you for your reply. I just want to confirm where the information after the audit is placed? Just like auditing, it usually places the audit logs in the /var/log/audit/log directory.

profsekar commented 6 months ago

Its configuration is controlled entirely by command line options. Please read the documentation and help message.