Fwd: Re: Fw: Audit records for start/stop auditd

[Steve Grubb]

On Friday 29 April 2005 14:58, David Woodhouse wrote:
> I suspect you're just seeing that auditd is
> dropping the message before it shuts down.

That whole scheme is too racy. The signal patch I sent works everytime. Chris 
has mentioned the possibility of netlink_unicast being a problem and I think 
that's the only problem left outstanding. That problem should be solved 
separately from the signal patch since its a generic problem with the audit 
netlink code.

-Steve