Re: audit-1.7.16 released
On Tue, Nov 17, 2009 at 3:48 PM, Steve Grubb <sgrubb(a)redhat.com> wrote:
On Monday 16 November 2009 06:52:24 pm LC Bruzenak wrote:
> > You should have daemon start/end events at the aggregator. Are they not
> > getting there? Also, the aggregator should have matching
> > connect/disconnect events.
>
> I am not getting the DAEMON_END events. In an orderly shutdown, the
> network shuts down before the audit daemon does.
OK, I'll take a look to see if things can be reordered to let this event get
sent.
-Steve
Thanks, that would help in the case where the client shuts down normally.
There is definitely utility in having a positive event come from the
sender saying it is shutting down.
But if the client gets the power cord yanked out it doesn't help me,
so I'll still try to add something on the server side to add a local
audit event as well as the syslog.
Thx,
LCB.
--
LC (Lenny) Bruzenak