On Saturday, December 13, 2014 07:26:09 PM Hassan Sultan wrote: > I can't figure out how to get audit log entries for process termination. > > Abnormal process termination auditing occurs, however for NORMAL process > termination, I can't find anything.
Programs typically call exit_group(2) which terminates all threads. -Steve -- Linux-audit mailing list [email protected] https://www.redhat.com/mailman/listinfo/linux-audit
