Benefit of 'arch' parameter for syscall rules

[Matt Rixon]

Hi everyone,
What is the benefit of using the 'arch' field parameter in a syscall rule?
Is it necessary?

Thanks,
Matt Rixon

--
Linux-audit mailing list
Linux-audit@redhat.com
https://www.redhat.com/mailman/listinfo/linux-audit