On Thursday, October 08, 2015 01:32:16 PM Bond Masuda wrote: > with linux audit, how do I monitor the deletion of directories? I am > already monitoring the unlink syscall, but it only seems to monitor > deleted files.
There is a rmdir syscall. Add that to your rule. -Steve -- Linux-audit mailing list Linux-audit@redhat.com https://www.redhat.com/mailman/listinfo/linux-audit
