Re: Watch Performance
On Friday 21 April 2006 11:01, Amy Griffis wrote:
> On Mon, Apr 17, 2006 at 10:27:34AM -0500, Timothy R. Chavez
wrote:
> > Maybe this is a completely stupid thought, but what about the option of
> > adding a per-syscall filter list table, indexed by system-call number.
This approach makes a lot of sense to me. I think it would be a good
next-step for audit filtering.
Al, proposed a different solution. You might want to check with him for
details. It was discussed at the Monday Telecon.
-Steve