If I restart auditd, can it lose (not record to the logs) events that happen during the restart? Or is the restart (and reload of new rules) essentially atomic? Thanks, --Chris -------------- next part -------------- An HTML attachment was scrubbed... URL: <http://listman.redhat.com/archives/linux-audit/attachments/20170206/ff06147d/attachment.htm>