| -f | leave the audit daemon in the foreground for debugging. Messages also go to stderr rather than the audit log. |
| -l | allow the audit daemon to follow symlinks for config files. |
SIGTERM caused auditd to discontinue processing audit events, write a shutdown audit event, and exit.
SIGUSR1 causes auditd to immediately rotate the logs. It will consult the max_log_size_action to see if it should keep the logs or not.
/etc/audit/audit.rules - audit rules to be loaded at startup