Skip to content

Commit

Permalink
Fix multiple typos
Browse files Browse the repository at this point in the history
Detected by lintian in Debian

Signed-off-by: Laurent Bigonville <bigon@bigon.be>
  • Loading branch information
bigon committed Oct 15, 2017
1 parent 71884e3 commit 8058a95
Show file tree
Hide file tree
Showing 4 changed files with 5 additions and 5 deletions.
2 changes: 1 addition & 1 deletion audisp/plugins/prelude/audisp-prelude.8
Original file line number Diff line number Diff line change
Expand Up @@ -31,7 +31,7 @@ If you are aggregating multiple machines, you should enable node information in

At this point, if you want have audit: forbidden login location, max concurrent sessions, max login failures, and forbidden login time anomalies being reported, you have to setup pam modules correctly. The pam modules are respectively: pam_access, pam_limits, pam_tally2, and pam_time. Please see the respective pam module man pages for any instructions.

For performance reasons, some audit events will not produce syscall records which contain additional information about events unless there is at least one audit rule loaded. If you do not have any additional audit rules, edit \fI/etc/audit/audit.rules\fP and add something simple that won't impact performace like this: \fB\-w /etc/shadow \-p wa\fP. This rule will watch the shadow file for writes or changes to its attributes. The additional audit information provided by having at least one rule will allow the plugin to give a more complete view of the alert it is sending.
For performance reasons, some audit events will not produce syscall records which contain additional information about events unless there is at least one audit rule loaded. If you do not have any additional audit rules, edit \fI/etc/audit/audit.rules\fP and add something simple that won't impact performance like this: \fB\-w /etc/shadow \-p wa\fP. This rule will watch the shadow file for writes or changes to its attributes. The additional audit information provided by having at least one rule will allow the plugin to give a more complete view of the alert it is sending.

If you are wanting to get alerts on watched syscalls, watched files, watched execution, or something becoming executable, you need to add some keys to your audit rules. For example, if you have the following audit watch in \fI/etc/audit/audit.rules\fP:

Expand Down
2 changes: 1 addition & 1 deletion docs/auparse_get_field_num.3
Original file line number Diff line number Diff line change
Expand Up @@ -7,7 +7,7 @@ auparse_get_field_num \- get current field cursor location
unsigned int auparse_get_field_num(auparse_state_t *au);

.SH "DESCRIPTION"
auparse_get_field_num will retreive the internal library cursors current field location in the current record. Fields within the same record are numbered starting from 0. This is generally not needed but there are some cases where one may want to know the exact field being looked at.
auparse_get_field_num will retrieve the internal library cursors current field location in the current record. Fields within the same record are numbered starting from 0. This is generally not needed but there are some cases where one may want to know the exact field being looked at.

.SH "RETURN VALUE"

Expand Down
2 changes: 1 addition & 1 deletion docs/auparse_get_record_num.3
Original file line number Diff line number Diff line change
Expand Up @@ -7,7 +7,7 @@ auparse_get_record_num \- get current record cursor location
unsigned int auparse_get_record_num(auparse_state_t *au);

.SH "DESCRIPTION"
auparse_get_record_num will retreive the internal library cursors current record location in the current event. Records within the same event are numbered starting from 0. This is generally not needed but there are some cases where one may want to know the exact record being looked at.
auparse_get_record_num will retrieve the internal library cursors current record location in the current event. Records within the same event are numbered starting from 0. This is generally not needed but there are some cases where one may want to know the exact record being looked at.

.SH "RETURN VALUE"

Expand Down
4 changes: 2 additions & 2 deletions lib/libaudit.c
Original file line number Diff line number Diff line change
Expand Up @@ -837,7 +837,7 @@ int audit_make_equivalent(int fd, const char *mount_point,
}

/*
* This function will retreive the loginuid or -1 if there
* This function will retrieve the loginuid or -1 if there
* is an error.
*/
uid_t audit_getloginuid(void)
Expand Down Expand Up @@ -901,7 +901,7 @@ int audit_setloginuid(uid_t uid)
}

/*
* This function will retreive the login session or -2 if there
* This function will retrieve the login session or -2 if there
* is an error.
*/
uint32_t audit_get_session(void)
Expand Down

0 comments on commit 8058a95

Please sign in to comment.