How can I correlate alerts with the log file line numbers ?
Each alert in the detail section will display the line numbers which contributed to the alert. Recall that [#alert-description alerts] are single descriptions of a denial which may have occurred multiple times in the log file, the line numbers will show you all the places in the log file where this same issue was identified. In addition [#denial-event denial events] are composed from multiple [#avc-message ]AVC messages which may or may not be contiguous in the log file (typically denial events have their independent AVC messages in close proximity, thus any given denial event tends to be “clustered”). The line numbers reported are for every AVC message which contributed to a denial event and each alert may be composed from multiple denial evants (e.g. the report count).
