Re: [PATCH] Enable splitting the logs to both auditd and kernel simultaneously
This came from an internal application and usecase at Samsung for our
mobile products. We don't have all these daemons in userspace, and
splitting coppying, and re-writing is a bit inefficient. Also,
suppose the case where different userspaces have different things that make
use of the netlink socket. They all would need to know that they need to
write the data back to kmsg.
Bill
On Tue, May 21, 2013 at 11:03 AM, Steve Grubb <sgrubb(a)redhat.com> wrote:
On Tuesday, May 21, 2013 10:40:24 AM William Roberts wrote:
> Allow the audit subsystem to send audit events to both the kernel
> message buffer and auditd at the same time.
>
> Signed-off-by: William Roberts <w.roberts(a)sta.samsung.com>
Out of curiosity, why would you want both auditd and sysloging of events?
Audispd also has a builtin service that sends events into syslog.
-Steve
--
Respectfully,
William C Roberts
Attachments:
- attachment.html (text/html — 1.4 KB)