[PATCH] audit: documentation of audit= kernel parameter

Eric Paris
2014-01-13T21:01:57Z

Further documentation of the 3 possible kernel value of the audit
command line option.

Signed-off-by: Eric Paris <eparis@redhat.com>
---
Documentation/kernel-parameters.txt | 8 ++++++++
1 file changed, 8 insertions(+)

diff --git a/Documentation/kernel-parameters.txt b/Documentation/kernel-parameters.txt
index ab86766..5867442 100644
--- a/Documentation/kernel-parameters.txt
+++ b/Documentation/kernel-parameters.txt
@@ -465,6 +465,14 @@ bytes respectively. Such letter suffixes can also be entirely omitted.

audit= [KNL] Enable the audit sub-system
Format: { "0" | "1" } (0 = disabled, 1 = enabled)
+ 0 - kernel audit is disabled and can not be enabled
+ until the next reboot
+ unset - kernel audit is partially enabled and will
+ be fully enabled by the userspace auditd
+ 1 - kernel audit is partially enabled just like 'unset'
+ only at most audit_backlog_limit messages will be
+ retained in RAM and forwarded to userspace auditd
+ when it being.
Default: unset

audit_backlog_limit= [KNL] Set the audit queue size limit.
--
1.8.4.2