watch dir problem

[Timothy R. Chavez]

On Thursday 26 May 2005 14:39, Steve Grubb wrote:
> Hello,
> 
> I got a capture of audit doing a log rotate using:
> 
> auditctl -w /var/log -k dir -p rwea
> 
> type=SYSCALL msg=audit(05/26/05 15:24:55.023:13588534) : arch=i386 
> syscall=rename success=yes exit=0 a0=94bc008 a1=94bc028 a2=8051254 a3=8054e00 
> items=2 pid=1716 auid=unknown(4294967295) uid=root gid=root euid=root 
> suid=root fsuid=root egid=root sgid=root fsgid=root comm=auditd 
> exe=/sbin/auditd
> type=FS_WATCH msg=audit(05/26/05 15:24:55.023:13588534) :  watch=log 
> filterkey=dir perm=read,write,exec,append perm_mask=exec inode=29249 
> inode_uid=root inode_gid=root inode_dev=03:07 inode_rdev=00:00
> type=FS_WATCH msg=audit(05/26/05 15:24:55.023:13588534) :  watch=log 
> filterkey=dir perm=read,write,exec,append perm_mask=exec inode=29249 
> inode_uid=root inode_gid=root inode_dev=03:07 inode_rdev=00:00
> type=PATH msg=audit(05/26/05 15:24:55.023:13588534) : item=0 
> name=/var/log/audit/audit.log inode=29307 dev=03:07 mode=dir,750 ouid=root 
> ogid=root rdev=00:00
> type=PATH msg=audit(05/26/05 15:24:55.023:13588534) : item=1 
> name=/var/log/audit/audit.log.1 inode=29307 dev=03:07 mode=dir,750 ouid=root 
> ogid=root rdev=00:00
> 
> The thing I'm wondering about is the mode not matching the object in PATH. The 
> watch is on a dir, but the item listed is not a dir, its a file with access 
> perms of 0640.

Is the inode being reported the inode of audit/ or audit.log?

-tim