auditctl question

[Steve Grubb]

On Wednesday 02 August 2006 18:15, Linda Knippers wrote:
> It doesn't work on RHEL4 U2.  I seem to recall that there was
> something funky about how to get failed syscalls back then but
> I don't recall the details.

Right, but that was not fixed due to audit system being under certification 
and a workaround was available and documented. At this point, the upstream 
kernel *should* work correctly or we forgot to fix it.

-Steve