Resuming auditing if the agent stops

If the dad service stops running for any reason, audited shell sessions will stop working and you will be prompted to resume or quit auditing. If you resume auditing, the cdawatch process attempts to start dad and connect to the installation. However, if you have manually stopped the dad process, for example by running /usr/share/centrifydc/bin/centrifyda stop, you must manually restart the agent.

If you decide to quit auditing when the dad service has stopped running, you are prompted to confirm that you want to terminate the session before the session ends.