<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.0 TRANSITIONAL//EN"> <HTML> <HEAD> <META HTTP-EQUIV="Content-Type" CONTENT="text/html; CHARSET=UTF-8"> <META NAME="GENERATOR" CONTENT="GtkHTML/3.18.3"> </HEAD> <BODY> Trying to find what is deleting a directory (/tmp/xauth). Thought I'd start with the basics, and just putting a watch on it. [bel@comsup]:/etc/audit > auditctl -w /testdir/checkdir -p rwxa -k missingfiles [bel@comsup]:/etc/audit > auditctl -l|grep missing LIST_RULES: exit,always dir=/testdir/checkdir (0x11) perm=rwxa key=missingfiles [bel@comsup]:/etc/audit > ausearch -k missingfiles <no matches> [bel@comsup]:/etc/audit > rmdir /testdir/checkdir [bel@comsup]:/etc/audit > ausearch -k missingfiles <no matches> [bel@comsup]:/etc/audit > auditctl -w /testdir/checkfile -p wrxa -k missingfiles [bel@comsup]:/etc/audit > rm /testdir/checkfile [bel@comsup]:/etc/audit > ausearch -k missingfiles ---- (lots of text here) Any suggestions on how to get it to do for a directory what it's doing for the file? I don't want to watch /tmp for adds/removes obviously; that would be silly. It is indeed a *directory* (regardless whether the directory contents show up) that I want to watch. Thanks, Brian LaMere </BODY> </HTML>