On Tuesday 15 September 2009 06:27:55 pm LC Bruzenak wrote: > Has there been any discussion about an option to make the auditd > unkillable?
No there hasn't. It has an immutable mode which will cause audit events to go to syslog in the event that auditd is stopped or crashes. -Steve -- Linux-audit mailing list [email protected] https://www.redhat.com/mailman/listinfo/linux-audit
