Steve Grubb wrote: > On Wednesday 15 March 2006 15:58, Jason Baron wrote: >> couldn't auditd keep track of the number of rules and enable or >> disable syscall auditing as appropriate? > > The simple answer is no. What's the not-so-simple answer? That sounds like an interesting idea. -- ljk