docs/resources/auditd.md.erb in inspec-1.40.0 vs docs/resources/auditd.md.erb in inspec-1.41.0
- old
+ new
@@ -4,10 +4,12 @@
# auditd
Use the `auditd` InSpec audit resource to test the rules for logging that exist on the system. The audit.rules file is typically located under /etc/audit/ and contains the list of rules that define what is captured in log files. These rules are output using the auditcl -l command. This resource supports versions of `audit` >= 2.3.
+<br>
+
## Syntax
An `auditd` resource block declares one (or more) rules to be tested, and then what that rule should do:
describe auditd do
@@ -21,35 +23,12 @@
its('lines') { should include %r(-a always,exit -F arch=.* -S chmod,fchmod,fchmodat -F auid>=1000 -F auid!=-1 -F key=.+) }
end
where each test must declare one (or more) rules to be tested.
+<br>
-## Matchers
-
-This InSpec audit resource has the following matchers:
-
-### be
-
-<%= partial "/shared/matcher_be" %>
-
-### cmp
-
-<%= partial "/shared/matcher_cmp" %>
-
-### eq
-
-<%= partial "/shared/matcher_eq" %>
-
-### include
-
-<%= partial "/shared/matcher_include" %>
-
-### match
-
-<%= partial "/shared/matcher_match" %>
-
## Examples
The following examples show how to use this InSpec audit resource.
### Test if a rule contains a matching element that is identified by a regular expression
@@ -89,5 +68,11 @@
The key filter may be useful in evaluating rules with particular key values:
describe auditd.where { key == "privileged" } do
its('permissions') { should include ['x'] }
end
+
+<br>
+
+## Matchers
+
+For a full list of available matchers please visit our [matchers page](https://www.inspec.io/docs/reference/matchers/).