![](/images/new-backgrounds/1308409/308409285x1.webp)
Templates and Alerts
Template Property Types
pathnames_1 f1 & f2 programs_1 p1
pathnames_2 f1 & f2 programs_2 p2
pathnames_3 f1 & f2 programs_3 p3
•However, it is not equal to the following: 4.
pathnames_1 f1
programs_1 p1 & p2 & p3
pathnames_2 f2 programs_2 p1 & p3
The rationale here is to provide a finer granularity for users to specify their file monitoring dependencies. That is, in (4) an alert for f2 will be generated if the event was triggered by p2, as opposed to what happens when any of (1), (2) or (3) are used.
Type III: UIDs
The values for this property consists of lists of UIDs that the template is to explicitly take into account (type IIIa) or explicitly ignore (type IIIb) when determining whether or not an alarm is to be issued. The following template property specifies three UIDs, which will be explicitly taken into account while generating an alert:
priv_uid_list 22 1 43
The following template property specifies that alerts concerning the three UIDs will not be generated:
uids_to_ignore 21 3 53
specifies three UIDs, which will be explicitly ignored, when generating an alert, depending on the template type.
Type IV: UID Pairs
In this case the values consist of lists of pairs of UIDs. In each pair, the two members are separated by a comma. When an event is received for a file that is being monitored, the following criteria are applied for every pair in the list:
•The effective UID of the process modifying this file is the same as the first member of the pair
•The owner of the file has the same UID as the second member of the pair
If both these conditions are true, no alert is issued.
In the following command line:
uid_pairs_to_ignore 2, 16 4, 3
Appendix A | 131 |