Exclusion with recursive watch

Ameel Kamboh akamboh at nortel.com
Thu Feb 19 15:30:05 UTC 2009


I am currently using audit-1.6.5-9.el5.
I have watch rules that look for modifications to directory content,
example:

    -w  /etc -p aw

I would like to add an exception not to watch "/etc/mydir".
I know that audit 1.6 will watch /etc and all subdirs within that.
Is there a way I can add this exception?

Thanks
Ameel
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://listman.redhat.com/archives/linux-audit/attachments/20090219/b95e7164/attachment.htm>


More information about the Linux-audit mailing list