[PATCH] Enable splitting the logs to both auditd and kernel simultaneously

Steve Grubb sgrubb at redhat.com
Tue May 21 18:03:57 UTC 2013


On Tuesday, May 21, 2013 10:40:24 AM William Roberts wrote:
> Allow the audit subsystem to send audit events to both the kernel
> message buffer and auditd at the same time.
> 
> Signed-off-by: William Roberts <w.roberts at sta.samsung.com>

Out of curiosity, why would you want both auditd and sysloging of events? 
Audispd also has a builtin service that sends events into syslog.

-Steve




More information about the Linux-audit mailing list