Re: Is audit really disabled?
On Wed, 2005-08-10 at 16:52 -0400, Steve Grubb wrote:
In case any messages need to get written to auditd. Not sure if we
want to
start and stop that thread based on audit_pid being/not being set. I would
defer that decision to David.
We start it at the first sign of userspace auditd/auditctl activity, and
we don't ever stop it. If you don't have the audit package installed, or
if you're never running audit tools, then you shouldn't see any sign of
kauditd.
--
dwmw2