<div class="gmail_quote">I'm noticing exactly the same problem mentioned into this old message <a href="http://osdir.com/ml/linux.redhat.security.audit/2006-07/msg00036.html" target="_blank">http://osdir.com/ml/linux.redhat.security.audit/2006-07/msg00036.html</a> Workaround consisting into watching the whole directory containing the file works too. I've found that into 2006 a patch was submitted to solve the issue <a href="http://www.mail-archive.com/linux-audit@redhat.com/msg00476.html" target="_blank">http://www.mail-archive.com/linux-audit@redhat.com/msg00476.html</a> Is this a recent regression, or is there something I don't know? Arch Linux audit 2.1.1 kernel 2.6.38.7 i686 architecture Thanks in advance </div>