On Thursday 18 May 2006 12:04, Michael C Thompson wrote: > So then it should be safe to say that having two -F msgtype=... is an > invalid construct for a rule? Since messages have only 1 type?
Only if they are using the '=' operator. Other operators might be valid to have multiple -F msgtype. -Steve -- Linux-audit mailing list [email protected] https://www.redhat.com/mailman/listinfo/linux-audit
