to support for wildcard notation

Steve Grubb sgrubb at redhat.com
Wed Mar 22 16:27:10 UTC 2006


>is there any way to support for wildcard notation. I must watch and monitor
>lots of files in some directories. This directories contain a lot of file and
>also contents are changed by users, sometimes they add another files, rarely
>they delete files, lots of times they change contents of files that are in
>directories.

Not in the RHEL4 kernel at this point. I think we are looking into this for a 
future update. Also, we are working on a new file system auditing kernel 
patch for future upstream acceptance and I believe that it will be able to 
support this.

Hope this helps...

-Steve




More information about the Linux-audit mailing list