Steve Grubb wrote: > On Friday 19 May 2006 14:47, Linda Knippers wrote: > >>But why does ausearch care? > > Ausearch doesn't care about this particular setting. Its looking at the > config > to find the log files. The parser is what cares and it is what emitted this > warning.
But why is it even a warning of the freq value is only valid if flush is set to incremental? > As such, you can use ausearch to make sure your config is sane > before sending sighup to reconfigure the audit daemon. Sounds like an odd use of ausearch. >>Seems like if anything cared it would be the auditd but I can't find an >>error or warning from it anywhere. > > Should be in the syslog. I see it after doing a HUP and when doing an /etc/init.d/auditd restart but not when auditd starts at boot time. -- ljk -- Linux-audit mailing list [email protected] https://www.redhat.com/mailman/listinfo/linux-audit
