<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 3.2//EN"> <HTML> <HEAD> <META HTTP-EQUIV="Content-Type" CONTENT="text/html; charset=us-ascii"> <META NAME="Generator" CONTENT="MS Exchange Server version 6.5.7653.38"> <TITLE>Example</TITLE> </HEAD> <BODY>  Can someone give me an example of how to audit the "date" command in the audit.rules file. I would like for it to report only failures for a user using the command. Root using the command would report nothing. I can get this working for file watches but not for executables using: -a exit,always -w /etc/shadow -S open -F success!=1 Thanks! </BODY> </HTML>