adding syscall rules

[Amy Griffis]

Timothy R. Chavez wrote:     [Wed Jun 08 2005, 05:24:52PM EDT]
> > I've noticed some odd behavior when adding medium to large numbers of
> > syscall rules.  I'm doing my testing on an ia64 system with the
> > audit.56 kernel and the audit-0.9.2 package.

<snip>

> I've seen similar problems with watches (when inserting and triggering
> them immediately after).  I've yet to hear of or see a solution to this 
> problem.  But, I know Steve had commented earlier on the hard limit of 
> 30 phenomena and a fix for it.

Okay, great.  I guess I missed that mail.

> Is there any way you can join the IRC channel (irc.freenode.net/6667)
> #audit -- We're mostly all there in the late morning between 10 - 12 CST.

Sure, thanks for the invite.

Amy