Hello Richard & Paul, I have been noticing something lately. I have applications that crash and I get a notification from abrtd but when I go looking, there is no matching ANOM_ABEND records. This is one a 4.11.11 kernel.
The purpose of the ANOM_ABEND record is to indicate that a program has crashed and receieved a SIGSEGV or any other signal that results in termination. By any chance has something changed where our hook is placed? I also can't tell you when this started, I have a feeling this has been happening for over a year. -Steve -- Linux-audit mailing list [email protected] https://www.redhat.com/mailman/listinfo/linux-audit
