PERFORCE change 135599 for review

[Christian S.J. Peron]

http://perforce.freebsd.org/chv.cgi?CH=135599

Change 135599 by csjp at ibm01 on 2008/02/17 22:39:38

	Add an example sequence which catches coredumps.

Affected files ...

.. //depot/projects/trustedbsd/bsmtrace/bsmtrace.conf#3 edit

Differences ...

==== //depot/projects/trustedbsd/bsmtrace/bsmtrace.conf#3 (text+ko) ====

@@ -191,3 +191,11 @@
 		object <pcre> { /[Ee][Tt][Cc]/*; };
 	};
 };
+
+sequence coredump {
+	subject any;
+	state {
+		event <auditevent> { AUE_CORE; };
+		status any;
+	};
+};