Re: [PATCH] Add End of Event record

John Dennis
2007-09-28T19:36:42Z

FYI: setroubleshoot has been modified to support AUDIT_EOE. If AUDIT_EOE
is seen and if the event is one being watched it is immediately flushed.

Also, if AUDIT_EOE is ever seen in the audit stream setroubleshootd then
disables it's 2 second timeout used to flush cached pending events.
Disabling the timeout should make the powertop folks happy because
setroubleshootd will no longer wake up as often.
--
John Dennis <jdennis@redhat.com>