Audit daemon going to single user mode

[Klaus Weidner]

On Wed, Apr 13, 2005 at 06:59:52PM -0400, Steve Grubb wrote:
> When the audit daemon goes to single user mode due to hitting a limit that 
> causes the action to be performed. Is the audit daemon supposed to stay alive 
> or should it quit? As of right now, it quits because the init scripts doesn't 
> have it in the single user run level setting.

I think auditd quitting is appropriate. The typical reason for the switch
to single user mode would be a fatal failure in the audit system (such as
out of disk space), so it's unlikely to be able to do anything useful
when continuing.

-Klaus