Re: Fwd: Re: Fw: Audit records for start/stop auditd
On Friday 29 April 2005 14:58, David Woodhouse wrote:
I suspect you're just seeing that auditd is
dropping the message before it shuts down.
That whole scheme is too racy. The signal patch I sent works everytime. Chris
has mentioned the possibility of netlink_unicast being a problem and I think
that's the only problem left outstanding. That problem should be solved
separately from the signal patch since its a generic problem with the audit
netlink code.
-Steve