-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

> Ok, I have it :_) just follow 289417820934 TIDs and install a lot of


We at Novell pride ourselves on our ability to have 289 billion TIDs in
existence. ;-)

It may be interesting to you to know more about why this has changed,
but if not feel free to skip this paragraph. In order to properly audit
a system the lowest levels must be involved in capturing data and while
there were other possible, flawed, ways to capture auditing information
from NSS volumes the correct way is via a kernel module. I think now
(vs. when that TID was first written) the kernel modules involved
(referred to as 'vigil') are installed automatically on OES 2 and 11,
but don't quote me on that. Either way the OES folks ship that code
since they are in charge of the NSS filesystem and auditing therein.

Because this is all new code anyway, and because there was no need (or
desire) to use the old code, it was written to handle greater
possibilities in terms of data and also to remove bottlenecks inherent
in the old Novell Audit-style of auditing (limited number of fields,
limited fields of each type of data, weird issues around the Platform
Agent and lcache, etc.) and an easy replacement was to send the data
using a protocol that looks like syslog. You've found out the rest, but
basically this works by having the kernel pick up the events and send
them to a little agent (kind of like the old Platform Agent) that
forwards the data to Sentinel.

Good luck.
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v2.0.18 (GNU/Linux)
Comment: Using GnuPG with Mozilla - http://enigmail.mozdev.org/

iQIcBAEBAgAGBQJP4cr2AAoJEF+XTK08PnB5NvgP/2sGVeARV4lWSsedvQPZKQTQ
NfC4wG3mLh2SJsOE4rMWZavJfLyzQ+UJLblWMNRZ0ZNvGlfN/oXalUNLgpDp8HD3
CRHz78rgVVbS66XqpCVv1Um5VCvW6KTsO8+jJvfnivE/M7OHu7Zgblc+PATa8a2U
c0KSoGW2i0HBpi7UfJuGbGhPCe1e5UBtvl/NPUqDnUX5xaM6Qel7ezkrUOs8l+lQ
itNT4dw61+/+4LkOjedFnZHtVYtfmcNs2hz4GbRxhRL9/bQganxMyg7qDG18q7S3
L5Heqgb7373iiLktYhqNbg1hf0qdAu3QH7mU18bha+Btw/odz3Hr1aTzYOTeE6Gs
0DVG5clDT5cMupYqdS7Gf90azmp6Yswu2Aw3VjxzeK7hBbpkQl uf+tWSyVB10tWB
Q+JYxesFTcyo2H2XVOh7/HaI4oADZtDYFJmNcbvobCkJ2uL+Ds/ZkSYqu8xvisUM
DhAjSb4rdew8rbQ053gOIFxjrl2jdp37+Ogm2aQAUUZHMPnGD+ +SsvDUi+s1+hz/
oYj0jaxhiyqzIKB6v6w92jWIUPQrRmQoaSqlZ6rDBegHiClSI0 H3Q2RohQGeBmPs
pEUy781d/+Dp+OyBCv04D/LUvkQ6j5c6ekbUYTs+N59U8iDZAvnTmlPVL+dpHH5f
EwG0/xgkPlHYLQZfCXR3
=+1+g
-----END PGP SIGNATURE-----