On Monday 16 November 2009 06:52:24 pm LC Bruzenak wrote: > > You should have daemon start/end events at the aggregator. Are they not > > getting there? Also, the aggregator should have matching > > connect/disconnect events. > > I am not getting the DAEMON_END events. In an orderly shutdown, the > network shuts down before the audit daemon does.
OK, I'll take a look to see if things can be reordered to let this event get sent. -Steve -- Linux-audit mailing list [email protected] https://www.redhat.com/mailman/listinfo/linux-audit
