On Monday, August 04, 2014 03:16:18 PM Gisela Cheng wrote: There are 2 kinds of events. Some are hardwired into the applications (or kernel) and they send them if auditing is enabled. The other kind are discretionary in that the admin defines what to audit. The problem with the discretionary rules are that it is from the kernel's point of view. Meaning that you only get events as the process transitions through something the kernel controls like files or syscalls. The SERVICE_START/STOP command are intended to be sent by the init daemon. Systemd already sends these. Upstart could be patched, but if that is done it would need to match the layout, order, and formatting of the systemd events. USER_CMD is for something like sudo to record what command the user will be running. It can't define these events because the kernel only sees a process start or stop. It has no idea that its a service. Only init can tell the difference. -Steve