Re: Identifying thread/process termination

Almost everywhere in the kernel we record the TGID for the "pid=" values and not the actual task/thread ID. That decision was made before my heavy involvement with audit, but my guess is that most audit users are focused more on security relevant events at the process level, not the thread level. After all, there isn't really much in the way of significant boundaries between threads.