[redhat-lspp] Re: [PATCH] testing new audit features

[Steve Grubb]

On Wednesday 05 April 2006 15:18, Steve Grubb wrote:
> >        audit_rule_syscallbyname((struct audit_rule *)rule, "all");
> >        rule->flags = AUDIT_FILTER_EXIT;
> >        rule->action = AUDIT_ALWAYS;

7) Also...what becomes of the watch_filter? Does it still work ? Is it still 
needed ?

-Steve