A question on monitoring time or time management changes in the kernel and the adjtimex system call
All,
Would it be correct to say that when one sees an adjtimex system call audit event, a
change has occurred ONLY if either a AUDIT_TIME_ADJNTPVAL (algorithm change) or
AUDIT_TIME_INJOFFSET (time change) record is present in the event?
Thanks in advance
Burn Alting
Attachments:
- attachment.html (text/html — 427 bytes)