| commit | c0641f28dcbecb6dc34a4fd003a9947fcd080696 | [log] [tgz] |
|---|---|---|
| author | Eric Paris <eparis@redhat.com> | Mon Jan 07 13:49:15 2008 -0500 |
| committer | Al Viro <viro@zeniv.linux.org.uk> | Fri Feb 01 14:07:19 2008 -0500 |
| tree | 75cc2700afe2e83834895e7f45c7f663faf2e034 | |
| parent | 4746ec5b01ed07205a91e4f7ed9de9d70f371407 [diff] |
[AUDIT] Add End of Event record This patch adds an end of event record type. It will be sent by the kernel as the last record when a multi-record event is triggered. This will aid realtime analysis programs since they will now reliably know they have the last record to complete an event. The audit daemon filters this and will not write it to disk. Signed-off-by: Steve Grubb <sgrubb redhat com> Signed-off-by: Eric Paris <eparis@redhat.com>