Hi Steve, I tried it on Fedora with audit 1.2.4 and the 2.6.17-based lspp.41 kernel and it seems to work there.
It doesn't work on RHEL4 U2. I seem to recall that there was something funky about how to get failed syscalls back then but I don't recall the details. -- ljk Steve Grubb wrote: > On Wednesday 02 August 2006 16:49, Lane Williams wrote: > >>Should the following work??? > > > Yes. > > >>auditctl -a exit,always -S all -F exit=-13 > > > If this does not work, we will need a kernel patch for it. > > -Steve > > -- > Linux-audit mailing list > [email protected] > https://www.redhat.com/mailman/listinfo/linux-audit -- Linux-audit mailing list [email protected] https://www.redhat.com/mailman/listinfo/linux-audit
