RFC: -k field value

Steve Grubb sgrubb at redhat.com
Wed Feb 29 13:35:49 UTC 2012


On Tuesday, February 28, 2012 08:16:12 PM Shawn Wells wrote:
> I'd like to see the audit -k field names match whatever we call the
> actual check. 

As they currently are, they describe the exact STIG requirement they fulfill. 
There is a comment above the rule and you should be able to correlate the key 
with the comment in every case. The purpose of the keys is so that this makes 
sense:

aureport --start today --key --summary

This is the first step in any investigation. What policy violations do I 
currently have?


> Right now they're (fairly arbitrary) strings from the stig.rules file. Any
> objection to changing them to match the rule name?

Yeah. I object. What would be the proposed change? How would it make the key 
report any more useful than it currently is?

-Steve


More information about the scap-security-guide mailing list