On 06/19/2018 03:52 PM, Steve Grubb wrote: > I think we want the modes field so that we know what was changed. But do we > really need to know maxerror or status? I think we should limit this to the > modes and any value of a time adjustment. > >> Note that this new auxiliary record gets only logged on *modifying* >> operations, which should not be that frequent, and thus it shouldn't >> be a problem to output a bit of potentially useful information. > We're after just security information.
+1. Sometimes more isn't merrier. :-) LCB -- Lenny Bruzenak MagitekLTD
-- Linux-audit mailing list [email protected] https://www.redhat.com/mailman/listinfo/linux-audit
