Hi,
Just wanted to let everyone know that a new version of the audit daemon has
been released. You can download tarball & srpm from
http://people.redhat.com/sgrubb/audit It will also be available in rawhide
tomorrow morning.
This release features a big cleanup of the auditctl code. I have new man pages
for it that hopefully makes life easier for people.
This release also features a new config option admin_space_left &
admin_space_left_action. This is meant to be the soft limit where you can
configure the system to go into single user mode. It should still leave a
configurable amount of space left for logging anything that occurs while
freeing up disk space or before you hit the hard limit. There's a few more
cleanups in the documentation and code.
Still not quite ready for beta testing but a little closer...
-Steve Grubb