Logging failed open() calls on /var/log/audit/audit.log

[Linda Knippers]

Steve Grubb wrote:
> On Tuesday 27 June 2006 17:15, Amy Griffis wrote:
> 
>>If you would like to see a record in this case, you must add a watch
>>for /var/log/audit.
> 
> 
> I don't see a record watching this either.

I think we're missing the directory lookup syscall(s) on watches
right now.

-- ljk