# This option is used to determine if rules & watches should be deleted on # shutdown by loading the audit-stop file. This is beneficial in most cases # so that a watch doesn't linger on a drive that is being unmounted. If # set to no, it will NOT be cleaned up. AUDITD_CLEAN_STOP="no" # This option determines whether or not to call augenrules to compile the # audit rules from /etc/audit/rules.d. The default is "yes". USE_AUGENRULES="yes"