#!/bin/bash
#
# Startup script for the Audit module and audit daemon
#
# chkconfig: 2345 98 10
# description: SNARE System iNtrusion Analysis and Reporting Environment
# processname: auditd
# config: /etc/audit/audit.conf

# Source function library.
. /etc/rc.d/init.d/functions

# Path to the auditd binary.
auditd=/usr/sbin/auditd
RETVAL=0

[ -x $auditd ] || exit 0

start() {
	gprintf "Loading audit kernel module: "
	insmod auditmodule >/dev/null
	echo
	gprintf "Starting auditd: "
	$auditd >/dev/null &
	RETVAL=$?
	echo
	[ $RETVAL = 0 ] && touch /var/lock/subsys/auditd
	return $RETVAL
}
stop() {
	gprintf "Stopping auditd and unloading audit kernel module: "
	killproc $auditd >/dev/null
	RETVAL=$?
	echo
	[ $RETVAL = 0 ] && rm -f /var/lock/subsys/auditd /var/run/auditd.pid
	rmmod auditmodule >/dev/null
}

# See how we were called.
case "$1" in
  start)
	start
	;;
  stop)
	stop
	;;
  status)
	status $auditd
	;;
  restart)
	stop
	start
	;;
  *)
	gprintf "Usage: audit {start|stop|restart|status}\n"
	exit 1
esac

exit $RETVAL
