auditctl behavior

[Steve Grubb]

On Wednesday 22 June 2005 02:58, you wrote:
> Could I have done this differently in the kernel to make it easier?

Not really. I use the ack flag for positive confirmation. When the new thread 
is spawned, the original returns and sends the ack. Before, the ack would 
come at the end.  Its fixed now.

> You also get a marker at the end of the list, right?

Yes. NLMSG_DONE.

-Steve