A question on monitoring time or time management changes in the kernel and the adjtimex system call

[Burn Alting]

All,

Would it be correct to say that when one sees an adjtimex system call audit event, a
change has occurred ONLY if either a AUDIT_TIME_ADJNTPVAL (algorithm change) or
AUDIT_TIME_INJOFFSET (time change) record is present in the event?

Thanks in advance
Burn Alting
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://listman.redhat.com/archives/linux-audit/attachments/20230109/128f7b30/attachment.htm>