(apologies if this is a dupe, received a bounce on my original posting) CCI-001488 requires that we do something when the auditd system fails. Right now we have no rules for that. For Red Hat's LSPP profiles we set failure mode to panic. Thoughts? Objections? -Shawn