Linux - Auditctl

To check audit buffer state :

auditctl -s

The architecture of Linux audit : see Linux C2-Style Audit Capability (2001-08-04)

No comments: