All, When rotating log files due a USR1 signal being sent, or for any other reason, does auditd finish writing all the records that belong to the current event being written before starting the new log file?
That is, will I find records belonging to a single event in two log files? If this is the case, would there be problems if auditd was changed to wait and 'flush' all an event's records before rotating? One assumes auditd-event.c would need to be modified to be more event aware. Perhaps make use of AUDIT_EOE or other means of identifying the end of an event or a single event. Thanks in advance Burn Alting
-- Linux-audit mailing list Linux-audit@redhat.com https://www.redhat.com/mailman/listinfo/linux-audit
