Re: SIGXCPU and Auditd
On Tuesday, November 05, 2013 07:16:21 PM Paul Davies C wrote:
In the man page it is written that *core dump on SIGXCPU **can fail*
.
That is probably the reason why it is not logged.
I think we would want the event even if the core dump failed. Maybe the hook
placement needs review? Its probably been 5 years since it was put in the
kernel...that's a lot of time for things to change.
-Steve