Re: audit_pid with multiple userspace auditd processes
Eric Paris wrote:
On Wed, 2009-01-07 at 17:04 -0500, Linda Knippers wrote:
> Eric Paris wrote:
>> So I noticed today something strange, but maybe not wrong?
>>
>> lets say userspace starts 2 copies of auditd.
> Will a second auditd actually start? Seems like it shouldn't.
depends how you start it. if you use init scripts, no it won't start
another one. If you just start auditd, nothing stops you.....
Seems like auditd itself could be a little smarter.
-- ljk