<html><body> <tt>linux-audit-bounces@redhat.com wrote on 04/06/2005 08:54:10 AM: > I wonder if we should have another audit message type AUDIT_TERM. Then in the > above function, do an if statement on SIGTERM or SIGKILL and send the > AUDIT_TERM message type. The message needs to be easily interpreted as the > audit system is being terminated. </tt> <tt>The current records are type DAEMON, and the messages state, "auditd start"</tt> <tt>and "auditd normal halt", so as far as administrator information, it is</tt> <tt>already clear what has happened.</tt></body></html>