How to Set Watches for NFS Automounts?

[Taylor_Tad at emc.com]

  From the client perspective (I should have said).  Certainly auditing
the mount works and you could set up something to "catch" this audit
event occurring and then set a watch point, but I'm hoping that there's
a more straightforward way to accomplish this.
  
  -----Original Message-----
From: Michael Folsom [mailto:mwfolsom at gmail.com] 
Sent: Tuesday, July 10, 2007 2:35 PM
To: Taylor, Tad
Cc: linux-audit at redhat.com
Subject: Re: How to Set Watches for NFS Automounts?
  
  Tad:
  
  Hmmmmmmmmmmm...
  
  From which perspective?  The client or the server?
  
  For the client how about putting a watch on the mount command?
  
  I added:
       -a entry,always -S mount
  
  to the end of /etc/audit.rules file and it works fine.
  
  Now re: the server I'm curious how to handle this myself.  Perhaps the
  same thing may work there too.........
  
  
  
  M-
  
  
  
  On 7/10/07, Taylor_Tad at emc.com <Taylor_Tad at emc.com> wrote:
  >
  >
  >
  >
  > I'm trying to figure out a way to set file system watches for NFS
file
  > systems that are automounted (i.e., they get mounted automatically
when
  > someone accesses them).
  >
  > When an NFS file system is already mounted, it's straightforward to
set a
  > watch on the path, however, for automounted file systems, you can't
set a
  > watch when the file system isn't mounted.  Any suggestions as to the
best
  > way to go about doing this?
  >
  >
  >
  > Thanks,
  >
  > --Tad Taylor
  > --
  > Linux-audit mailing list
  > Linux-audit at redhat.com
  > https://www.redhat.com/mailman/listinfo/linux-audit
  >