From mboxrd@z Thu Jan 1 00:00:00 1970 From: Eric Paris Subject: [PATCH] audit: documentation of audit= kernel parameter Date: Mon, 13 Jan 2014 16:01:57 -0500 Message-ID: <1389646917-27632-1-git-send-email-eparis@redhat.com> Mime-Version: 1.0 Content-Type: text/plain; charset="us-ascii" Content-Transfer-Encoding: 7bit Return-path: List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Sender: linux-audit-bounces@redhat.com Errors-To: linux-audit-bounces@redhat.com To: rbriggs@redhat.com Cc: linux-audit@redhat.com List-Id: linux-audit@redhat.com Further documentation of the 3 possible kernel value of the audit command line option. Signed-off-by: Eric Paris --- Documentation/kernel-parameters.txt | 8 ++++++++ 1 file changed, 8 insertions(+) diff --git a/Documentation/kernel-parameters.txt b/Documentation/kernel-parameters.txt index ab86766..5867442 100644 --- a/Documentation/kernel-parameters.txt +++ b/Documentation/kernel-parameters.txt @@ -465,6 +465,14 @@ bytes respectively. Such letter suffixes can also be entirely omitted. audit= [KNL] Enable the audit sub-system Format: { "0" | "1" } (0 = disabled, 1 = enabled) + 0 - kernel audit is disabled and can not be enabled + until the next reboot + unset - kernel audit is partially enabled and will + be fully enabled by the userspace auditd + 1 - kernel audit is partially enabled just like 'unset' + only at most audit_backlog_limit messages will be + retained in RAM and forwarded to userspace auditd + when it being. Default: unset audit_backlog_limit= [KNL] Set the audit queue size limit. -- 1.8.4.2