Further documentation of the 3 possible kernel value of the audit command line option. Signed-off-by: Eric Paris <eparis(a)redhat.com&gt; --- Documentation/kernel-parameters.txt | 8 ++++++++ 1 file changed, 8 insertions(+) diff --git a/Documentation/kernel-parameters.txt b/Documentation/kernel-parameters.txt index ab86766..5867442 100644 --- a/Documentation/kernel-parameters.txt +++ b/Documentation/kernel-parameters.txt @@ -465,6 +465,14 @@ bytes respectively. Such letter suffixes can also be entirely omitted. audit= [KNL] Enable the audit sub-system Format: { "0" | "1" } (0 = disabled, 1 = enabled) + 0 - kernel audit is disabled and can not be enabled + until the next reboot + unset - kernel audit is partially enabled and will + be fully enabled by the userspace auditd + 1 - kernel audit is partially enabled just like 'unset' + only at most audit_backlog_limit messages will be + retained in RAM and forwarded to userspace auditd + when it being. Default: unset audit_backlog_limit= [KNL] Set the audit queue size limit. -- 1.8.4.2