FYI: setroubleshoot has been modified to support AUDIT_EOE. If AUDIT_EOE is seen and if the event is one being watched it is immediately flushed.
Also, if AUDIT_EOE is ever seen in the audit stream setroubleshootd then disables it's 2 second timeout used to flush cached pending events. Disabling the timeout should make the powertop folks happy because setroubleshootd will no longer wake up as often. -- John Dennis <[EMAIL PROTECTED]> -- Linux-audit mailing list [email protected] https://www.redhat.com/mailman/listinfo/linux-audit
