Re: is this message necessary?
I just noticed the message is similarly vague when system call
rules are removed. It just says "removed an audit rule".
-- ljk
Steve Grubb wrote:
On Wednesday 09 November 2005 18:02, Linda Knippers wrote:
>I'm wondering about the usefulness of this message since it doesn't
>identify the watch that's being removed.
This denotes that a configuration change has occurred. This is needed.
>If we need this message, shouldn't it identify the watch that's being
>removed?
That would be nice. In the new file system audit code, maybe we can add the
file name?
Thanks,
-Steve
--
Linux-audit mailing list
Linux-audit(a)redhat.com
https://www.redhat.com/mailman/listinfo/linux-audit