Re: Audit daemon going to single user mode
On Wed, Apr 13, 2005 at 06:59:52PM -0400, Steve Grubb wrote:
When the audit daemon goes to single user mode due to hitting a limit
that
causes the action to be performed. Is the audit daemon supposed to stay alive
or should it quit? As of right now, it quits because the init scripts doesn't
have it in the single user run level setting.
I think auditd quitting is appropriate. The typical reason for the switch
to single user mode would be a fatal failure in the audit system (such as
out of disk space), so it's unlikely to be able to do anything useful
when continuing.
-Klaus