I am writing puppet modules for work now. I am writing a module specifically oriented around audit for Linux and Solaris.

But I would like to know is after updating audit.rules in Linux with immutable mode turned on; is a restart of the audit process actually required for the rules to take effect.

I believe it always is, but I want to be certain.

Thanks,

\\Warron French from mobile