From: Eric Paris Date: Mon, 13 Jan 2014 21:01:06 +0000 (-0500) Subject: audit: documentation of audit= kernel parameter X-Git-Tag: firefly_0821_release~176^2~4072^2~41 X-Git-Url: http://demsky.eecs.uci.edu/git/?a=commitdiff_plain;h=d7961148258cfe19908b5a29941a8c9f3fa7a4d6;p=firefly-linux-kernel-4.4.55.git audit: documentation of audit= kernel parameter Further documentation of the 3 possible kernel value of the audit command line option. Signed-off-by: Eric Paris --- diff --git a/Documentation/kernel-parameters.txt b/Documentation/kernel-parameters.txt index ab86766e28cb..e81e1d0d8d78 100644 --- a/Documentation/kernel-parameters.txt +++ b/Documentation/kernel-parameters.txt @@ -465,6 +465,14 @@ bytes respectively. Such letter suffixes can also be entirely omitted. audit= [KNL] Enable the audit sub-system Format: { "0" | "1" } (0 = disabled, 1 = enabled) + 0 - kernel audit is disabled and can not be enabled + until the next reboot + unset - kernel audit is initialized but disabled and + will be fully enabled by the userspace auditd. + 1 - kernel audit is initialized and partially enabled, + storing at most audit_backlog_limit messages in + RAM until it is fully enabled by the userspace + auditd. Default: unset audit_backlog_limit= [KNL] Set the audit queue size limit.