<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 3.2//EN">
<HTML>
<HEAD>
<META HTTP-EQUIV="Content-Type" CONTENT="text/html; charset=us-ascii">
<META NAME="Generator" CONTENT="MS Exchange Server version 6.5.7233.69">
<TITLE>Audit rule questions</TITLE>
</HEAD>
<BODY>
<!-- Converted from text/rtf format -->
<P><FONT SIZE=2 FACE="Arial">All,</FONT>
</P>
<P><FONT SIZE=2 FACE="Arial">Is there a way to set a rule to watch particular files in a directory like /etc/*? Can you use wildcards in the rules?</FONT>
</P>
<P><FONT SIZE=2 FACE="Arial">Also, is there a way to set a rule to grab just non-root user actions on a file?</FONT>
</P>
<P><FONT SIZE=2 FACE="Arial">Thanks!</FONT>
</P>
</BODY>
</HTML>