On Thursday 19 February 2009 10:30:05 am Ameel Kamboh wrote: > -w /etc -p aw > > I would like to add an exception not to watch "/etc/mydir". > I know that audit 1.6 will watch /etc and all subdirs within that. > Is there a way I can add this exception?
Not today. That is a kernel issue. Al corrected this in a patch that should have landed in the 2.6.29 kernel. I believe this will also be fixed in the next RHEL kernel. -Steve -- Linux-audit mailing list [email protected] https://www.redhat.com/mailman/listinfo/linux-audit
