On Wednesday 10 January 2007 11:08, Linda Knippers wrote: > > So the question is, should ausearch report the actual recorded register > > value, or should it "and" the register with IPC_64 ? > > Since we're auditing syscalls, I think audit should report what the > syscall sees.
OK, that's fine with me. But I wonder where all this should be documented so that we don't get bugzilla's opened by concerned users. Would any particular man page be better than others? -Steve -- Linux-audit mailing list [email protected] https://www.redhat.com/mailman/listinfo/linux-audit
