[PATCH] Enable splitting the logs to both auditd and kernel simultaneously
Steve Grubb
sgrubb at redhat.com
Tue May 21 18:03:57 UTC 2013
On Tuesday, May 21, 2013 10:40:24 AM William Roberts wrote:
> Allow the audit subsystem to send audit events to both the kernel
> message buffer and auditd at the same time.
>
> Signed-off-by: William Roberts <w.roberts at sta.samsung.com>
Out of curiosity, why would you want both auditd and sysloging of events?
Audispd also has a builtin service that sends events into syslog.
-Steve
More information about the Linux-audit
mailing list