From mboxrd@z Thu Jan 1 00:00:00 1970 From: "Chu Li" Subject: RE: [Patch]Fix the error in the output of "auditctl -s" when auditd is stoped Date: Fri, 8 Aug 2008 09:10:06 +0800 Message-ID: <003801c8f8f3$7e7d9580$958da70a@truly> References: <005e01c8f849$27634f60$958da70a@truly> <200808071701.33912.sgrubb@redhat.com> Return-path: In-Reply-To: <200808071701.33912.sgrubb@redhat.com> List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Sender: linux-audit-bounces@redhat.com Errors-To: linux-audit-bounces@redhat.com To: 'Steve Grubb' Cc: 'linux-audit' List-Id: linux-audit@redhat.com Hi Steve, > we can make updates that change the external behavior. If you want, we can > document this better in man pages that audit pid of 0 means its not running. I agree with it. At least it's necessary to add some simple explanation about "pid=0" in the manual. Regards Chu Li > -----Original Message----- > From: Steve Grubb [mailto:sgrubb@redhat.com] > Sent: Friday, August 08, 2008 5:02 AM > To: Chu Li > Cc: 'linux-audit' > Subject: Re: [Patch]Fix the error in the output of "auditctl -s" when auditd is > stoped > > On Thursday 07 August 2008 00:50:45 Chu Li wrote: > > When auditd is stoped, "auditctl -s" will show "pid=0". I think it's not > > correct information. It's better to tell users "auditd not started". > > At the moment, I don't want to change this behavior. In about a month, I think > we can make updates that change the external behavior. If you want, we can > document this better in man pages that audit pid of 0 means its not running. > > Thanks, > -Steve