General instructions for testing the new Snare kernel patch:
------------------------------------------------------------
For redhat users:

Pull down a compatible version of the kernel:
cd /usr/src; wget http://www.kernel.org/pub/linux/kernel/v2.4/linux-2.4.22.tar.gz

Install:
* tar xzf linux-2.4.22.tar.gz

Patch and compile the kernel
* patch -p0 </path/to/SNARE-diff
* cd linux-2.4.22
* make mrproper
* make clean
* cp /boot/*conf* .config
* make oldconfig
  - Turn on C2_AUDIT under General when the option comes up.
  - leave other options as default, unless you know what they're doing.
* make dep
* make
* make modules
* make modules_install
* make install

Install the Snare audit daemon
* cd;tar xzf /path/to/auditd.tar.gz
* cd auditd*
* make
* make install

Reboot your system, and select the new patched kernel from the GRUB/Lilo list
- Modify the /etc/audit/audit.conf file appropriately.
  - unfortunately, the new GUI is not yet ready for release.
- restart the audit daemon
* service snare restart
--------------------------------------------------------------------------------

The kernel patch version of Snare includes all capabilities of the module
version, plus:
* The addition of module load/unload auditing
* Better details on connect/accept auditing (source/dest ip and port, and protocol)
* A much nicer communications system between kernel and audit daemon.
* 'Parent Process ID' information for forensics information.