From mboxrd@z Thu Jan 1 00:00:00 1970 From: LC Bruzenak Subject: RE: questions about auditing on a new RH 6 box Date: Fri, 14 Jan 2011 11:35:06 -0600 Message-ID: <1295026506.2041.19.camel@lcb> References: <1295023346.15499.1.camel@localhost.localdomain> Mime-Version: 1.0 Content-Type: text/plain; charset="us-ascii" Content-Transfer-Encoding: 7bit Return-path: Received: from mx1.redhat.com (ext-mx09.extmail.prod.ext.phx2.redhat.com [10.5.110.13]) by int-mx01.intmail.prod.int.phx2.redhat.com (8.13.8/8.13.8) with ESMTP id p0EHZUgt026461 for ; Fri, 14 Jan 2011 12:35:30 -0500 Received: from webserver.magitekltd.com (rrcs-24-242-137-197.sw.biz.rr.com [24.242.137.197]) by mx1.redhat.com (8.13.8/8.13.8) with ESMTP id p0EHZD2E010605 for ; Fri, 14 Jan 2011 12:35:13 -0500 In-Reply-To: List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Sender: linux-audit-bounces@redhat.com Errors-To: linux-audit-bounces@redhat.com To: "Tangren, Bill" Cc: "linux-audit@redhat.com" List-Id: linux-audit@redhat.com Probably can use a sampling of events as well. LCB -- LC (Lenny) Bruzenak lenny@magitekltd.com