Hi, I can't figure out how to get audit log entries for process termination.
Abnormal process termination auditing occurs, however for NORMAL process termination, I can't find anything.
I tried the syscall route, using the exit syscall, however this does not seem to work, maybe because it logs on exit of the syscall and that call never returns ?
How can I get a log of all processes exiting then ? Thanks, Hassan -- Linux-audit mailing list [email protected] https://www.redhat.com/mailman/listinfo/linux-audit
