[redhat-lspp] Re: audit messages during bootup

[schaufler-ca.com - Casey Schaufler]

--- LC Bruzenak <lenny at bruzenak.com> wrote:

> It is my experience that auditing is desired to be
> integral at all run
> levels. Casey - did the SGI CMW also have
> single-user auditing?

The only audit that's relevent in single-user is
administrator actions, e.g. changes to system
configuration data. As that's done with special
tools (covici is fun) that maintain the information
under revision control the audit system doesn't
need to be running.

The audit system deals with user events. No
users, no user events.


------------------------
Casey Schaufler
casey at schaufler-ca.com
650.906.1780