make auditd persistent?
Steve (or anyone),
Has there been any discussion about an option to make the auditd unkillable? If it was already touched on the list, I apologize - I lost the old emails.
Thx,
LCB.
Signature · 2 lines
LC (Lenny) Bruzenak [email protected]
Quoted 2 lines · LC Bruzenak
Has there been any discussion about an option to make the auditd unkillable?
No there hasn't. It has an immutable mode which will cause audit events to go to syslog in the event that auditd is stopped or crashes.
-Steve