This is an old revision of the document!
Linux Audit to BSM conversion
Structure
- A Linux Audit log file is made of events.
- An event is made of records which share the same timestamp and id.
- A record has a type, a timestamp, an id and an arbitrary number of fields.
- A field has a name and a value. It looks like this: name=value.