Well it would certainly have been a feat for them to audit launchd jobs in 10.3! :D Speaking of which, can you provide a reference? This is more than mildly intriguing to me.
I filed a bug report for this about a year ago for 10.4, but I discovered it when someone complained that access to files were not being audited by BSM. My tests showed access via the local shell (i.e., from the Terminal app) generated audit records fine, but coming in remotely via ssh meant that all your activities were *not* audited.
After further investigations I tracked it down to any process being launched from launchd (e.g., remote ssh login or a timed process). When looking at the audit mask for these processes, it is set to all zeros (meaning no events will generate a record) regardless what the BSM configuration files said.
(Note: the BSM audit system for 10.5 is fundamentally broken, so pretty much nothing is audited.)
Todd _______________________________________________ Cocoa-dev mailing list (Cocoa-dev@lists.apple.com) Please do not post admin requests or moderator comments to the list. Contact the moderators at cocoa-dev-admins(at)lists.apple.com Help/Unsubscribe/Update your Subscription: http://lists.apple.com/mailman/options/cocoa-dev/archive%40mail-archive.com This email sent to [EMAIL PROTECTED]
