Is audit really disabled?

[David Woodhouse]

On Wed, 2005-08-10 at 16:52 -0400, Steve Grubb wrote:
> In case any messages need to get written to auditd. Not sure if we want to 
> start and stop that thread based on audit_pid being/not being set. I would 
> defer that decision to David.

We start it at the first sign of userspace auditd/auditctl activity, and
we don't ever stop it. If you don't have the audit package installed, or
if you're never running audit tools, then you shouldn't see any sign of
kauditd.

-- 
dwmw2