From mboxrd@z Thu Jan  1 00:00:00 1970
From: Steve Grubb <sgrubb@redhat.com>
Subject: Re: How to monitor audit/audispd killed
Date: Tue, 05 Jan 2016 09:10:55 -0500
Message-ID: <5861142.vTemG0RS1M@x2>
References: <CAH8ERfatWjaVOyawRPT9Zb8cBE=3cYWoxd4Y5YYU_E7c8rozaQ@mail.gmail.com>
	<2955652.6SqtRXJnWL@x2>
	<CAH8ERfZF6EaKZrFUwDHSoRF7bqzu4ZRxf99w+pB4ab82ORcLcw@mail.gmail.com>
Mime-Version: 1.0
Content-Type: text/plain; charset="us-ascii"
Content-Transfer-Encoding: 7bit
Return-path: <linux-audit-bounces@redhat.com>
In-Reply-To: <CAH8ERfZF6EaKZrFUwDHSoRF7bqzu4ZRxf99w+pB4ab82ORcLcw@mail.gmail.com>
List-Unsubscribe: <https://www.redhat.com/mailman/options/linux-audit>,
	<mailto:linux-audit-request@redhat.com?subject=unsubscribe>
List-Archive: <https://www.redhat.com/archives/linux-audit>
List-Post: <mailto:linux-audit@redhat.com>
List-Help: <mailto:linux-audit-request@redhat.com?subject=help>
List-Subscribe: <https://www.redhat.com/mailman/listinfo/linux-audit>,
	<mailto:linux-audit-request@redhat.com?subject=subscribe>
Sender: linux-audit-bounces@redhat.com
Errors-To: linux-audit-bounces@redhat.com
To: Matthew Chao <mathewchao@gmail.com>
Cc: "linux-audit@redhat.com" <linux-audit@redhat.com>
List-Id: linux-audit@redhat.com

On Tuesday, January 05, 2016 06:08:54 PM Matthew Chao wrote:
> >"You can watch audispd, but I don't think that will help anything.
> 
> my program totally depends on audispd to dispatch audit messages. I think
> audispd need more robust mechanisms to monitor itself killed, otherwise
> which inevitably leads to that audispd' plugins receive nothing but always
> wait wait wait for event messages.
> 
> So are there some alternative ways to monitor audispd killed in audit
> ver1.8 ?

To help you, I need to know more about what the actual problem is that you are 
trying to solve. Would you like to explain the problem so we can help figure 
out how to address it?

Thanks,
-Steve