Hi Steve, > we can make updates that change the external behavior. If you want, we can > document this better in man pages that audit pid of 0 means its not running. I agree with it. At least it's necessary to add some simple explanation about "pid=0" in the manual.
Regards Chu Li > -----Original Message----- > From: Steve Grubb [mailto:[EMAIL PROTECTED] > Sent: Friday, August 08, 2008 5:02 AM > To: Chu Li > Cc: 'linux-audit' > Subject: Re: [Patch]Fix the error in the output of "auditctl -s" when auditd > is > stoped > > On Thursday 07 August 2008 00:50:45 Chu Li wrote: > > When auditd is stoped, "auditctl -s" will show "pid=0". I think it's not > > correct information. It's better to tell users "auditd not started". > > At the moment, I don't want to change this behavior. In about a month, I think > we can make updates that change the external behavior. If you want, we can > document this better in man pages that audit pid of 0 means its not running. > > Thanks, > -Steve -- Linux-audit mailing list [email protected] https://www.redhat.com/mailman/listinfo/linux-audit
