On Mon, 14 Feb 2005 14:32:36 CST, Kris Wilson said:
 I found that when I stop auditd, any existing audit rules still
exist, but
 they are
 deleted when I restart using audit-0.6.2.  Is this new behavior deliberate
 and
 preferred?  Is there a new option to not delete rules on startup?  All our
 tests
 are stopping and restarting auditd between assertions and cleaning out the
 log file to reduce clutter.  We'll need to change the tests if this will no
 longer
 work.  If users have a lot of rules created but have to bring down auditd
 for
 some reason, won't this be a problem? 
List the rules in /etc/audit.rules (new file added in 0.6.2)....