As part of the continuing series of Linux system event auditing I need another spec to bang my head against.
What I need is a brief spec indicating what you're trying to accomplish and anything you might think is relevant to your environment. I'll then do my best to build out a config to do it and post it up on the Information Security Stack Exchange blog.
The first installment of this post is at Stump the Chump with Auditd 01 and the original spec at: https://security.meta.stackexchange.com/a/1411/618
So in the answers please spec out what you want to accomplish and I'll try to build out an auditd config to match and publish it on the blog.