file change tracking

[Steve Grubb]

On Tuesday 10 July 2007 11:56:37 am Simmons Jr,Felix wrote:
> Could someone confirm for me what Vi is doing to the file that pops a
> perm_mask=2 (write) event?

Its opening the file with the intent to write. vi -R is readonly mode.


> On a side note, when I do actually write to the file (via vi or
> redirecting text) I get 7 separate type=FS_WATCH....perm_mask=2 events.
> I can live with the multiples but anyone have any idea why I see that
> for one file write?

Because there are probably 7 write syscalls. The audit system's view of the 
world is very much like strace's. You can use strace to confirm that.

-Steve