docs/resources/auditd.md.erb in inspec-1.40.0 vs docs/resources/auditd.md.erb in inspec-1.41.0

- old
+ new

@@ -4,10 +4,12 @@ # auditd Use the `auditd` InSpec audit resource to test the rules for logging that exist on the system. The audit.rules file is typically located under /etc/audit/ and contains the list of rules that define what is captured in log files. These rules are output using the auditcl -l command. This resource supports versions of `audit` >= 2.3. +<br> + ## Syntax An `auditd` resource block declares one (or more) rules to be tested, and then what that rule should do: describe auditd do @@ -21,35 +23,12 @@ its('lines') { should include %r(-a always,exit -F arch=.* -S chmod,fchmod,fchmodat -F auid>=1000 -F auid!=-1 -F key=.+) } end where each test must declare one (or more) rules to be tested. +<br> -## Matchers - -This InSpec audit resource has the following matchers: - -### be - -<%= partial "/shared/matcher_be" %> - -### cmp - -<%= partial "/shared/matcher_cmp" %> - -### eq - -<%= partial "/shared/matcher_eq" %> - -### include - -<%= partial "/shared/matcher_include" %> - -### match - -<%= partial "/shared/matcher_match" %> - ## Examples The following examples show how to use this InSpec audit resource. ### Test if a rule contains a matching element that is identified by a regular expression @@ -89,5 +68,11 @@ The key filter may be useful in evaluating rules with particular key values: describe auditd.where { key == "privileged" } do its('permissions') { should include ['x'] } end + +<br> + +## Matchers + +For a full list of available matchers please visit our [matchers page](https://www.inspec.io/docs/reference/matchers/).