RFC: -k field value
Steve Grubb
sgrubb at redhat.com
Wed Feb 29 13:35:49 UTC 2012
On Tuesday, February 28, 2012 08:16:12 PM Shawn Wells wrote:
> I'd like to see the audit -k field names match whatever we call the
> actual check.
As they currently are, they describe the exact STIG requirement they fulfill.
There is a comment above the rule and you should be able to correlate the key
with the comment in every case. The purpose of the keys is so that this makes
sense:
aureport --start today --key --summary
This is the first step in any investigation. What policy violations do I
currently have?
> Right now they're (fairly arbitrary) strings from the stig.rules file. Any
> objection to changing them to match the rule name?
Yeah. I object. What would be the proposed change? How would it make the key
report any more useful than it currently is?
-Steve
More information about the scap-security-guide
mailing list