Audit restart

Microsoft.Linux.Universal.Process.Audit.Restart (Recovery)

Element properties:

Target	Microsoft.Linux.Universal.OperatingSystem
Monitor	Microsoft.Linux.Universal.Process.Audit.Monitor
Reset Monitor	False
Remotable	True
Timeout	300
Category	Maintenance
Enabled	false
Accessibility	Public

Member Modules:

ID	Module Type	TypeId	RunAs
StartProcess.Audit	WriteAction	Microsoft.Unix.WSMan.ExecuteCommand.WriteAction	Default

Source Code:

<Recovery ID="Microsoft.Linux.Universal.Process.Audit.Restart" Accessibility="Public" Enabled="false" Target="Universal!Microsoft.Linux.Universal.OperatingSystem" Monitor="Microsoft.Linux.Universal.Process.Audit.Monitor" ExecuteOnDiagnostic="Microsoft.Linux.Universal.Process.Audit.Diagnostic" Remotable="true" ResetMonitor="false" Timeout="300">

  <Category>Maintenance</Category>

  <WriteAction ID="StartProcess.Audit" TypeID="Unix!Microsoft.Unix.WSMan.ExecuteCommand.WriteAction">

    <TargetSystem>$Target/Host/Property[Type="Unix!Microsoft.Unix.Computer"]/PrincipalName$</TargetSystem>

    <Command>service auditd start</Command>

  </WriteAction>

</Recovery>