audit.63 kernel.

Steve Grubb sgrubb at redhat.com
Mon Jun 20 15:09:42 UTC 2005


On Monday 20 June 2005 05:52, David Woodhouse wrote:
> I think that Tim and I between us have now addressed just
> about everything which was outstanding -- what did we miss?

There is something new that I noticed...all the SYSCALL messages have items=1. 
It didn't used to be this way. It used to be the number of aux records 
associated with the syscall event.

-Steve




More information about the Linux-audit mailing list