<html><body> Can you give me an example of the use of -i Thanks. David Flatley CISSP <img width="16" height="16" src="cid:1__=0ABBFC8CDFF2F3728f9e8a93df938@us.ibm.com" border="0" alt="Inactive hide details for Steve Grubb ---08/27/2009 01:32:35 PM---On Thursday 27 August 2009 01:21:43 pm David Flatley wrote: >">Steve Grubb ---08/27/2009 01:32:35 PM---On Thursday 27 August 2009 01:21:43 pm David Flatley wrote: > When auditd starts and reports an e <table width="100%" border="0" cellspacing="0" cellpadding="0"> <tr valign="top"><td width="1%"><img width="96" height="1" src="cid:2__=0ABBFC8CDFF2F3728f9e8a93df938@us.ibm.com" border="0" alt=""> From:</td><td width="100%"><img width="1" height="1" src="cid:2__=0ABBFC8CDFF2F3728f9e8a93df938@us.ibm.com" border="0" alt=""> Steve Grubb <sgrubb@redhat.com></td></tr> <tr valign="top"><td width="1%"><img width="96" height="1" src="cid:2__=0ABBFC8CDFF2F3728f9e8a93df938@us.ibm.com" border="0" alt=""> To:</td><td width="100%"><img width="1" height="1" src="cid:2__=0ABBFC8CDFF2F3728f9e8a93df938@us.ibm.com" border="0" alt=""> David Flatley/Burlington/IBM@IBMUS</td></tr> <tr valign="top"><td width="1%"><img width="96" height="1" src="cid:2__=0ABBFC8CDFF2F3728f9e8a93df938@us.ibm.com" border="0" alt=""> Cc:</td><td width="100%" valign="middle"><img width="1" height="1" src="cid:2__=0ABBFC8CDFF2F3728f9e8a93df938@us.ibm.com" border="0" alt=""> linux-audit@redhat.com</td></tr> <tr valign="top"><td width="1%"><img width="96" height="1" src="cid:2__=0ABBFC8CDFF2F3728f9e8a93df938@us.ibm.com" border="0" alt=""> Date:</td><td width="100%"><img width="1" height="1" src="cid:2__=0ABBFC8CDFF2F3728f9e8a93df938@us.ibm.com" border="0" alt=""> 08/27/2009 01:32 PM</td></tr> <tr valign="top"><td width="1%"><img width="96" height="1" src="cid:2__=0ABBFC8CDFF2F3728f9e8a93df938@us.ibm.com" border="0" alt=""> Subject:</td><td width="100%"><img width="1" height="1" src="cid:2__=0ABBFC8CDFF2F3728f9e8a93df938@us.ibm.com" border="0" alt=""> Re: buffer space</td></tr> </table> <hr width="100%" size="2" align="left" noshade style="color:#8091A5; "> <tt>On Thursday 27 August 2009 01:21:43 pm David Flatley wrote: > When auditd starts and reports an error on a line in the audit.rules, > does auditd continue to run with the rest of the rules? > Or does auditd stop waiting for a correction to the rules file? It depends on whether or not its processed a "-i" directive in the rules. If not, it stops. If so, it continues. -Steve </tt> </body></html>