Logging failed open() calls on /var/log/audit/audit.log

[Amy Griffis]

Steve Grubb wrote:     [Tue Jun 27 2006, 05:21:05PM EDT]
> On Tuesday 27 June 2006 17:15, Amy Griffis wrote:
> > If you would like to see a record in this case, you must add a watch
> > for /var/log/audit.
> 
> I don't see a record watching this either.

Hmmm, you're right.

In this implementation, a directory lookup isn't considered an access
of the object, but a directory listing is.