Document SIGCONT usage for auditd

caidongyun · Jun 29, 2018 · 30f06c2 · 30f06c2
1 parent bf5f3cf
commit 30f06c2
Showing 1 changed file with 6 additions and 0 deletions.
diff --git a/docs/auditd.8 b/docs/auditd.8
@@ -49,6 +49,9 @@ causes auditd to immediately rotate the logs. It will consult the max_log_file_a
 .TP
 SIGUSR2
 causes auditd to attempt to resume logging. This is usually needed after logging has been suspended.
+.TP
+SIGCONT
+causes auditd to dump a report of internal state to /var/run/auditd.state.
 
 .SH FILES
 .B /etc/audit/auditd.conf
@@ -59,6 +62,9 @@ causes auditd to attempt to resume logging. This is usually needed after logging
 .P
 .B /etc/audit/rules.d/
 - directory holding individual sets of rules to be compiled into one file by augenrules.
+.P
+.B /var/run/auditd.state
+- report about internal state.
 
 .SH NOTES
 A boot param of audit=1 should be added to ensure that all processes that run before the audit daemon starts is marked as auditable by the kernel. Not doing that will make a few processes impossible to properly audit.