If I restart auditd, can it lose (not record to the logs) events that happen during the restart? Or is the restart (and reload of new rules) essentially atomic?
Thanks, --Chris
-- Linux-audit mailing list [email protected] https://www.redhat.com/mailman/listinfo/linux-audit
