RHEL 4, Auditing

[List Quest]

Hi All;

I trying RHEL 4.x series auditing.

Example:
Audit version: audit-1.0.15-3.EL4

-w /root -p w

config line added to audit.rules; but this config watch only "/root"
directory writes. Do not watch "/root/Desktop", "/root/test", etc...

I can't recusive directory watch; like audit version audit-1.7.17-3

How this?


Thank you
Best Regards.
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://listman.redhat.com/archives/linux-audit/attachments/20100720/9cff7dba/attachment.htm>