Hi Richard, On Tue, 2020-06-09 at 13:15 -0400, Richard Guy Briggs wrote: > On 2020-06-09 10:00, Lakshmi Ramasubramanian wrote:
> If it is added, it should be appended to the end of the record since it > is an existing record format, then in the case of res=1, errno= should > still be present (not swing in and out) and just contain zero. (Or > another value if there is a non-fatal warning?) Thank you for the clarification. Mimi -- Linux-audit mailing list Linux-audit@redhat.com https://www.redhat.com/mailman/listinfo/linux-audit
