On Tuesday 30 May 2006 16:45, Michael C Thompson wrote: > I would read the second rule as saying "do not exclude messages of type > SYSCALL". Is this a correct interpretation of the rule?
That sounds reasonable, but I don't think that's what the kernel does. Maybe it should be corrected. I think its a 1 or 2 liner. -Steve -- Linux-audit mailing list [email protected] https://www.redhat.com/mailman/listinfo/linux-audit
