From mboxrd@z Thu Jan  1 00:00:00 1970
From: Steve Grubb <sgrubb@redhat.com>
Subject: Re: Fw: How to define rule for SERVICE_START/STOP?
Date: Tue, 05 Aug 2014 12:48:22 -0400
Message-ID: <2027195.kI1qZKnNKp@x2>
References: <OFC7FB0EAB.C448828F-ON85257D2B.00499E1F-85257D2B.00503A04@us.ibm.com>
Mime-Version: 1.0
Content-Type: text/plain; charset="us-ascii"
Content-Transfer-Encoding: 7bit
Return-path: <linux-audit-bounces@redhat.com>
In-Reply-To: <OFC7FB0EAB.C448828F-ON85257D2B.00499E1F-85257D2B.00503A04@us.ibm.com>
List-Unsubscribe: <https://www.redhat.com/mailman/options/linux-audit>,
	<mailto:linux-audit-request@redhat.com?subject=unsubscribe>
List-Archive: <https://www.redhat.com/archives/linux-audit>
List-Post: <mailto:linux-audit@redhat.com>
List-Help: <mailto:linux-audit-request@redhat.com?subject=help>
List-Subscribe: <https://www.redhat.com/mailman/listinfo/linux-audit>,
	<mailto:linux-audit-request@redhat.com?subject=subscribe>
Sender: linux-audit-bounces@redhat.com
Errors-To: linux-audit-bounces@redhat.com
To: Gisela Cheng <giselac@us.ibm.com>
Cc: linux-audit@redhat.com
List-Id: linux-audit@redhat.com

On Tuesday, August 05, 2014 10:36:17 AM Gisela Cheng wrote:
> Would this trigger the creation of the audit record? 

I don't think anything in the config file would affect this. The requirements are 
to record all starts and stops. I don't think it can record a segfault kind of 
stop. That would, however, generate an ANOM_ABEND event.


> Our application is expected to be up and running all the time.  But we can
> shut it down, or it could be down due to error.  We want audit record when
> it is down. Would TimeoutStopSec=  tag (don't know if this is the proper
> name)  does it, or I need other special tag? 

No tag should affect this.

-Steve