<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 3.2//EN">
<HTML>
<HEAD>
<META HTTP-EQUIV="Content-Type" CONTENT="text/html; charset=us-ascii">
<META NAME="Generator" CONTENT="MS Exchange Server version 6.5.7652.24">
<TITLE>Audit with path exception rule</TITLE>
</HEAD>
<BODY>
<!-- Converted from text/rtf format -->
<P><FONT SIZE=2 FACE="Arial">I would like to audit the file system for anyone creating new files</FONT>
<BR><FONT SIZE=2 FACE="Arial">However I would like to exclude a directory from the watch list.</FONT>
</P>
<P><FONT SIZE=2 FACE="Arial">Here is the sample I have:</FONT>
</P>
<P><FONT SIZE=2 FACE="Arial">#3. create/Remove any files</FONT>
<BR><FONT SIZE=2 FACE="Arial">-a exit,always -S creat -F path!=/var/myApp <--- line 21</FONT>
<BR><FONT SIZE=2 FACE="Arial">-a exit,always -S unlink -F path!=/var/myApp</FONT>
</P>
<P><FONT SIZE=2 FACE="Arial">This is giving me the following error:</FONT>
</P>
<P><FONT SIZE=2 FACE="Arial">auditctl -R test.rules</FONT>
<BR><FONT SIZE=2 FACE="Arial">No rules</FONT>
<BR><FONT SIZE=2 FACE="Arial">AUDIT_STATUS: enabled=1 flag=1 pid=3413 rate_limit=0 backlog_limit=1024 lost=0 backlog=0</FONT>
<BR><FONT SIZE=2 FACE="Arial">Error sending add rule data request (Invalid argument)</FONT>
<BR><FONT SIZE=2 FACE="Arial">There was an error in line 21 of test.rules</FONT>
</P>
<P><B><I><SPAN LANG="ko"><FONT COLOR="#008080" FACE="Batang">Ameel Kamboh</FONT></SPAN></I></B>
<BR><I><SPAN LANG="en-us"><FONT COLOR="#800000" SIZE=2 FACE="Arial">SIP Core</FONT></SPAN></I><SPAN LANG="en-us"><FONT COLOR="#800000" SIZE=2 FACE="Arial"> Network and Security </FONT></SPAN>
<BR><SPAN LANG="fr"><FONT COLOR="#FF0000" SIZE=2 FACE="Arial">Phone</FONT><FONT SIZE=2 FACE="Arial">: 972.685.4922 (esn 445-4922)</FONT></SPAN>
<BR><SPAN LANG="fr"><FONT COLOR="#FF0000" SIZE=2 FACE="Arial">Mobile</FONT><FONT SIZE=2 FACE="Arial">: 978-590-2280</FONT></SPAN>
<BR><SPAN LANG="fr"><FONT COLOR="#FF0000" SIZE=2 FACE="Arial">SIP</FONT><FONT SIZE=2 FACE="Arial">: akamboh@techtrial.com</FONT></SPAN>
<BR><SPAN LANG="fr"><FONT COLOR="#FF0000" SIZE=2 FACE="Arial">email</FONT><FONT SIZE=2 FACE="Arial">: </FONT></SPAN><A HREF="mailto:akamboh@nortel.com"><SPAN LANG="fr"><U><FONT COLOR="#0000FF" SIZE=2 FACE="Arial">akamboh@nortel.com</FONT></U></SPAN></A><SPAN LANG="fr"></SPAN><SPAN LANG="en-us"></SPAN>
</P>
<BR>
<BR>
</BODY>
</HTML>