From hsu@mail.clinet.fi  Sat Aug 22 18:58:35 1998
Received: from lohi.clinet.fi (lohi.clinet.fi [194.100.0.7])
          by hub.freebsd.org (8.8.8/8.8.8) with ESMTP id SAA02062
          for <FreeBSD-gnats-submit@freebsd.org>; Sat, 22 Aug 1998 18:58:33 -0700 (PDT)
          (envelope-from hsu@mail.clinet.fi)
Received: from katiska.clinet.fi (katiska.clinet.fi [194.100.0.4])
	by lohi.clinet.fi (8.9.1/8.9.0) with ESMTP id EAA17360
	for <FreeBSD-gnats-submit@freebsd.org>; Sun, 23 Aug 1998 04:58:08 +0300 (EEST)
Received: (from root@localhost)
	by katiska.clinet.fi (8.9.0/8.9.0) id EAA15512;
	Sun, 23 Aug 1998 04:57:48 +0300 (EEST)
Message-Id: <199808230157.EAA15512@katiska.clinet.fi>
Date: Sun, 23 Aug 1998 04:57:48 +0300 (EEST)
From: Heikki Suonsivu <hsu@clinet.fi>
Reply-To: hsu@clinet.fi
To: FreeBSD-gnats-submit@freebsd.org
Subject: Changes to acct format
X-Send-Pr-Version: 3.2

>Number:         7722
>Category:       kern
>Synopsis:       Changes to acct format
>Confidential:   no
>Severity:       non-critical
>Priority:       medium
>Responsible:    freebsd-bugs
>State:          closed
>Quarter:        
>Keywords:       
>Date-Required:  
>Class:          change-request
>Submitter-Id:   current-users
>Arrival-Date:   Sat Aug 22 19:00:00 PDT 1998
>Closed-Date:    Sat Nov 12 11:29:14 GMT 2005
>Last-Modified:  Sat Nov 12 11:29:14 GMT 2005
>Originator:     Heikki Suonsivu
>Release:        FreeBSD 2.2.6-STABLE i386
>Organization:
Clinet, Espoo, Finland
>Environment:

FreeBSD.

>Description:

Current acct records do not carry information about pid and ppid.  This is
not necessary for traditional accounting purposes, but for tracking
security issues this would be very useful.

Also the command data is very limited (20 characters only).  It might be
helpful to get more information about exec being done, full path, etc.

>How-To-Repeat:

man 5 acct

>Fix:
	
Add pid, ppid and more verbose command format.

>Release-Note:
>Audit-Trail:
State-Changed-From-To: open->suspended 
State-Changed-By: kris 
State-Changed-When: Thu May 24 12:58:23 PDT 2001 
State-Changed-Why:  
This PR is unlikely to get addressed unless someone 
submits patches. 

http://www.FreeBSD.org/cgi/query-pr.cgi?pr=7722 

From: Robert Watson <rwatson@FreeBSD.org>
To: kris@FreeBSD.org
Cc: hsu@clinet.fi, bug-followup@FreeBSD.org
Subject: Re: kern/7722: Changes to acct format
Date: Sat, 12 Nov 2005 11:19:56 +0000 (GMT)

 On Thu, 24 May 2001 kris@FreeBSD.org wrote:
 
 > Synopsis: Changes to acct format
 >
 > State-Changed-From-To: open->suspended
 > State-Changed-By: kris
 > State-Changed-When: Thu May 24 12:58:23 PDT 2001
 > State-Changed-Why:
 > This PR is unlikely to get addressed unless someone
 > submits patches.
 
 FYI, this requirement will be met by the new audit subsystem being 
 introduced in the near future, which will provide detailed (and 
 configurable) information about process interactions and tracing.
 
 Robert N M Watson
State-Changed-From-To: suspended->closed 
State-Changed-By: rwatson 
State-Changed-When: Sat Nov 12 11:28:09 GMT 2005 
State-Changed-Why:  
Close this PR as the submitter e-mail address bounces with User unknown. 
The feature request will be met by the upcoming audit feature. 


http://www.freebsd.org/cgi/query-pr.cgi?pr=7722 
>Unformatted:
