audit [Was: quota deadlock on 6.1-RC1]

[Robert Watson]

On Fri, 5 May 2006, Rong-En Fan wrote:

>> So what to expect in the future?  A slightly less agressive feature 
>> schedule for major releases -- 5.x had UFS2, KSE, SMPng, TrustedBSD, 
>> OpenPAM, a new gcc, etc.  6.x had significant network stack refinements, 
>> VFS SMPng work, etc, but nothing like the feature list of 5.x.  The main 
>> distinguishing factor for 7.x right now is Audit, which while a good bullet 
>> feature, but relatively non-intrusive.  I'd expect to see further UFS and 
>> VFS work, etc, possibly including a move to UFS journalling from the bgfsck 
>> model, a Giant-free NFS client, further refinement of locking in the 
>> storage stack, ARM support, and so on.  But by driving feature integration 
>> by schedule, things should go more smoothly.  For example, Audit is in 7.x 
>> -- we wanted to merge it for 6.1, but decided that the 6.1 schedule simply 
>> didn't allow it, so it will likely appear in 6.2 and 7.0.  That's a lot 
>> better than merging it prematurely, deferring the release 6 months for it 
>> to stabilize, and shipping it prematurely anyway.
>
> Speaking of audit, are there any HOWTOs?  Or some docs that explain what 
> audit can do and perhaps some simple examples. I'm really confused after 
> looking at TrustedBSD site.

Rong-En,

Sorry about the delay in getting back to you; I was at the FreeBSD Developer 
Summit and BSDCan conference in Ottawa, Canada, for the last week, so wasn't 
very online. Right now the main user documentation we have can be found in the 
FreeBSD Handbook:

     http://www.freebsd.org/doc/en_US.ISO8859-1/books/handbook/audit.html

Was this one of the documents you looked at before?  It's gone through some 
revision in the past month.  Are there specific secctions you find hard to 
follow that can be fixed up?  I know Tom has been working actively to improve 
the document, and I've also revised some pieces of it.

Thanks,

Robert N M Watson