Re: Fw: How to define rule for SERVICE_START/STOP?
On Tuesday, August 05, 2014 10:36:17 AM Gisela Cheng wrote:
Would this trigger the creation of the audit record?
I don't think anything in the config file would affect this. The requirements are
to record all starts and stops. I don't think it can record a segfault kind of
stop. That would, however, generate an ANOM_ABEND event.
Our application is expected to be up and running all the time. But
we can
shut it down, or it could be down due to error. We want audit record when
it is down. Would TimeoutStopSec= tag (don't know if this is the proper
name) does it, or I need other special tag?
No tag should affect this.
-Steve