• Eric Paris's avatar
    [AUDIT] Add End of Event record · c0641f28
    Eric Paris authored
    
    
    This patch adds an end of event record type. It will be sent by the kernel as
    the last record when a multi-record event is triggered. This will aid realtime
    analysis programs since they will now reliably know they have the last record
    to complete an event. The audit daemon filters this and will not write it to
    disk.
    
    Signed-off-by: Steve Grubb <sgrubb redhat com>
    Signed-off-by: default avatarEric Paris <eparis@redhat.com>
    c0641f28