audit-1.7.16 released
Steve Grubb
sgrubb at redhat.com
Tue Nov 17 21:48:28 UTC 2009
On Monday 16 November 2009 06:52:24 pm LC Bruzenak wrote:
> > You should have daemon start/end events at the aggregator. Are they not
> > getting there? Also, the aggregator should have matching
> > connect/disconnect events.
>
> I am not getting the DAEMON_END events. In an orderly shutdown, the
> network shuts down before the audit daemon does.
OK, I'll take a look to see if things can be reordered to let this event get
sent.
-Steve
More information about the Linux-audit
mailing list