Re: [PATCH] Add End of Event record

FYI: setroubleshoot has been modified to support AUDIT_EOE. If AUDIT_EOE is seen and if the event is one being watched it is immediately flushed. Also, if AUDIT_EOE is ever seen in the audit stream setroubleshootd then disables it's 2 second timeout used to flush cached pending events. Disabling the timeout should make the powertop folks happy because setroubleshootd will no longer wake up as often. -- John Dennis <jdennis(a)redhat.com&gt;