Re: make auditd persistent?
On Tuesday 15 September 2009 06:27:55 pm LC Bruzenak wrote:
Has there been any discussion about an option to make the auditd
unkillable?
No there hasn't. It has an immutable mode which will cause audit events to go
to syslog in the event that auditd is stopped or crashes.
-Steve