need rules help

[LC Bruzenak]

I searched the list for an example but see nothing applicable.
I need to be able to exclude the following event example:

node=jcdx type=PATH msg=audit(07/20/2009 00:00:16.469:24295) : item=0
name=/var/opt/jcdx/tracks/mltrackdb/AcousticTracks.inst/040fd238ede9dfbbc19e012c7633836f/AcousticTracks 
node=jcdx type=CWD msg=audit(07/20/2009 00:00:16.469:24295) :  cwd=/ 
node=jcdx type=SYSCALL msg=audit(07/20/2009 00:00:16.469:24295) :
arch=i386 syscall=stat64 success=no exit=-13(Permission denied)
a0=8813598 a1=ffdfed24 a2=c91ff4 a3=ffdfee5c items=1 ppid=1 pid=2747
auid=unset uid=root gid=unknown(450) euid=root suid=root fsuid=root
egid=unknown(450) sgid=unknown(450) fsgid=unknown(450) tty=(none)
ses=4294967295 comm=mtdb exe=/opt/jcdx/sbin/mtdb
subj=system_u:system_r:jcdx_mtdb_t:s0-s6:c0.c511 key=(null) 
node=jcdx type=AVC msg=audit(07/20/2009 00:00:16.469:24295) : avc:
denied  { search } for  pid=2747 comm=mtdb
name=040fd238ede9dfbbc19e012c7633836f dev=dm-0 ino=71632
scontext=system_u:system_r:jcdx_mtdb_t:s0-s6:c0.c511
tcontext=system_u:object_r:jcdx_stdb_var_t:s15:c0.c1023 tclass=dir 


I thought that the following would work:
-a never,exit -F subj_type=jcdx_mtdb_t -F obj_type=jcdx_stdb_var_t

but it doesn't stop the event from getting into the log.

I saw Steve's suggestion back in January about using the exclude rule,
but that one says "only msgtype field works with exclude filter", so I
cannot include any other "-F" options.

Any ideas?

Thx,
LCB.

-- 
LC (Lenny) Bruzenak
lenny at magitekltd.com