On Thu, 2016-12-29 at 16:04 -0800, Rick Stevens wrote:
> I think you're right, though it requires a close reading of
the man
> page to understand this. Anyway I've enabled it in the audit rules and
> so far it seems to work.
Huzzah! Hope that's "the magic bullet" for you.
Unfortunately it's still doing it.
poc