All, Would it be correct to say that when one sees an adjtimex system call audit event, a change has occurred ONLY if either a AUDIT_TIME_ADJNTPVAL (algorithm change) or AUDIT_TIME_INJOFFSET (time change) record is present in the event?
Thanks in advance Burn Alting
-- Linux-audit mailing list Linux-audit@redhat.com https://listman.redhat.com/mailman/listinfo/linux-audit
