<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 3.2//EN">
<HTML>
<HEAD>
<META HTTP-EQUIV="Content-Type" CONTENT="text/html; charset=us-ascii">
<META NAME="Generator" CONTENT="MS Exchange Server version 6.5.7653.38">
<TITLE>Exclusion with recursive watch</TITLE>
</HEAD>
<BODY>
<!-- Converted from text/rtf format -->
<P><FONT SIZE=2 FACE="Arial">I am currently using audit-1.6.5-9.el5.</FONT>
<BR><FONT SIZE=2 FACE="Arial">I have watch rules that look for modifications to directory content, example:</FONT>
</P>
<P><FONT SIZE=2 FACE="Arial"> -w /etc -p aw</FONT>
</P>
<P><FONT SIZE=2 FACE="Arial">I would like to add an exception not to watch "/etc/mydir".</FONT>
<BR><FONT SIZE=2 FACE="Arial">I know that audit 1.6 will watch /etc and all subdirs within that.</FONT>
<BR><FONT SIZE=2 FACE="Arial">Is there a way I can add this exception?</FONT>
<BR>
<BR><FONT SIZE=2 FACE="Arial">Thanks</FONT>
<BR><FONT SIZE=2 FACE="Arial">Ameel</FONT>
</P>
</BODY>
</HTML>