Fw: How to define rule for SERVICE_START/STOP?

[Steve Grubb]

On Tuesday, August 05, 2014 10:36:17 AM Gisela Cheng wrote:
> Would this trigger the creation of the audit record? 

I don't think anything in the config file would affect this. The requirements are 
to record all starts and stops. I don't think it can record a segfault kind of 
stop. That would, however, generate an ANOM_ABEND event.


> Our application is expected to be up and running all the time.  But we can
> shut it down, or it could be down due to error.  We want audit record when
> it is down. Would TimeoutStopSec=  tag (don't know if this is the proper
> name)  does it, or I need other special tag? 

No tag should affect this.

-Steve