On Wednesday 17 May 2006 17:43, Michael C Thompson wrote: > # auditctl -a entry,always -S chmod -F "watch=/root/file" > -F unknown field: watch=/root/file Ok, I misread what you were reporting...sorry. It is like this: auditctl -a exit,always -S chmod -F path=/root/file Must be exit list and use path not watch. -Steve