Audit and file watching

Amy Griffis amy.griffis at hp.com
Wed Jun 14 18:44:30 UTC 2006


Steve wrote:     [Wed Jun 14 2006, 01:46:59PM EDT]
> >I expected to see unlink...
> >
> >Any ideas?
> 
> This may be a result of the discussion posted previously:
> 
> [PATCH git] fix missing records when watched files removed
> 
> If so, please ignore this.

Yes.  If you don't have that patch, you won't see the unlink event.




More information about the Linux-audit mailing list