On Tuesday 26 July 2005 16:48, Amy Griffis wrote: > # auditctl -a entry,always open > > # auditctl -l > AUDIT_LIST: entry,always syscall=all > No watches jeez. I wished this was reported a long time ago. This behavior has probably been there from the beginning. I'm glad you are reporting it. Adding to TODO list... -Steve