[ossec-dev] Re: src / dst patch

["Daniel Cid" <dcid@xxxxxxxxx>]

Hi Sebastien,

Patch committed. I kept the alert output the same way it was before,
to avoid upgrading
problems... On a next major release, I plan to re-design the output
model and we will
add the src/dst user names.

Thanks,

Daniel

On 8/28/07, Sebastien Tricaud <sebastien.tricaud@xxxxxxxxx> wrote:
> Hello people,
>
> just as stated in  my last email [1], I updated the patch upon cvs head.
>
> For a quick summary: user and dstuser were ambiguous. user was always
> the destination user, unless we had a source user, such as with su,
> where the source user would be in user and the destination user in dstuser.
>
> Rulesets are updated along with the patch.
>
> Please now consider the following:
> * You don't always need to fill srcuser and/or dstuser
> * If you have both information, then think "Where does this event come
> from ?" to discover the source user and "Who is the target ?" to
> discover the destination user
> * If you don't know, then just fill dstuser
>
>
> Thanks, patch attached,
> Sebastien.
>
>
> [1]
> http://groups.google.com/group/ossec-dev/browse_thread/thread/b28ffd95f758fa5d/a71f3206d4eb1b01
>
>