[RFC] Do away with entry filter

Steve Grubb sgrubb at redhat.com
Fri Feb 27 18:19:06 UTC 2009


On Friday 27 February 2009 12:48:30 pm Linda Knippers wrote:
> I'm suggesting changing the name to something that makes a little
> more sense, or doing away with it if it isn't necessary for syscalls
> anymore.  I'm assuming that's the case because there's no need to
> distinguish it from "entry", so could we just drop "exit" and
> ignore it (silently or otherwise) in the transition?

We still have user, task, and exclude filters. So we still need to be able to 
specify them.

-Steve




More information about the Linux-audit mailing list