audit_pid with multiple userspace auditd processes

[Linda Knippers]

Eric Paris wrote:
> On Wed, 2009-01-07 at 17:04 -0500, Linda Knippers wrote:
>> Eric Paris wrote:
>>> So I noticed today something strange, but maybe not wrong?
>>>
>>> lets say userspace starts 2 copies of auditd.  
>> Will a second auditd actually start?  Seems like it shouldn't.
> 
> depends how you start it.  if you use init scripts, no it won't start
> another one.  If you just start auditd, nothing stops you.....

Seems like auditd itself could be a little smarter.

-- ljk