This came from an internal application and usecase at Samsung for our mobile products. We don't have all these daemons in userspace, and splitting coppying, and re-writing is a bit inefficient. Also,

suppose the case where different userspaces have different things that make use of the netlink socket. They all would need to know that they need to write the data back to kmsg.

Bill

On Tue, May 21, 2013 at 11:03 AM, Steve Grubb <sgrubb@redhat.com> wrote:

On Tuesday, May 21, 2013 10:40:24 AM William Roberts wrote:
> Allow the audit subsystem to send audit events to both the kernel
> message buffer and auditd at the same time.
>
> Signed-off-by: William Roberts <w.roberts@sta.samsung.com>

Out of curiosity, why would you want both auditd and sysloging of events?
Audispd also has a builtin service that sends events into syslog.

-Steve

--
Respectfully,

William C Roberts