We recently implemented some auditd rules in response to an external security audit. My colleague offered some input on them and suggested adding
-f 2 to
/etc/audit.rules. I can't think of an instance when I would want to induce a kernel panic outside of testing.
Can anyone suggest real-world, production situations that would warrant this?