Re: [PATCH] Enable splitting the logs to both auditd and kernel simultaneously
On Tuesday, May 21, 2013 10:40:24 AM William Roberts wrote:
Allow the audit subsystem to send audit events to both the kernel
message buffer and auditd at the same time.
Signed-off-by: William Roberts <w.roberts(a)sta.samsung.com>
Out of curiosity, why would you want both auditd and sysloging of events?
Audispd also has a builtin service that sends events into syslog.
-Steve