In RHEL 6.2,
the /usr/share/doc/audit-2.1.3/nispom.rules page says:
...
## Set failure mode to panic
-f 2
...
Yet, I do not see a "-f" option documented in the audit.rules(7) man page.
man auditd shows a -f option, but that does not look applicable.
Is this option an artifact of an earlier rev of auditd, and no longer
applicable now?
I see an option in /etc/audit/auditd.conf, "disk_full_action = ", that
seems to closely
match what that nispom option seems to be trying to do.
If the "-f" option is current, where is it and those other nispom options
documented?
Regards, Scott
--
Linux-audit mailing list
[email protected]
https://www.redhat.com/mailman/listinfo/linux-audit
