-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 Pete Briggs wrote: > Is there any way to put a watch on a directory, so that an audit record > will be generated if anyone cd's to that directory. I've tried things > like: > > -w /etc/audit/ -k ACCESS_AUDIT > > but the rule never seems to get invoked. I'm running FC7 with > audit-1.5.3
Let me add to this question ? Is it feasible to watch a top level directory recursively ? ie say /opt and not /opt/mydir/mymoredir/ etc ? - -- You see things; and you say 'Why?'; But I dream things that never were; and I say 'Why not?' - George Bernard Shaw -----BEGIN PGP SIGNATURE----- Version: GnuPG v1.4.7 (GNU/Linux) Comment: Using GnuPG with Fedora - http://enigmail.mozdev.org iD8DBQFGzErKXQZpNTcrCzMRAg3RAJ9x665sUBd5hzRjdX3x/g3bGdk6eACgpQn9 Wueth9+1jtrA+1S/za0qsgY= =qowH -----END PGP SIGNATURE----- -- Linux-audit mailing list [email protected] https://www.redhat.com/mailman/listinfo/linux-audit
