Disabling monitoring of a subfolder

Marina Gray marina.gray at itselearning.ca
Thu Nov 24 14:46:57 UTC 2011


I have a folder which I'd like to monitor with auditd, with the
exception of one specific subdirectory. Is there any way I can disable
monitoring just that subdirectory, but keep monitoring the rest of the
dir recursively as usual?

Say, I first do:

auditctl -w /var/mydata/ -k my-data -p w

and want to exclude looking at /var/mydata/tmp_data/


Thanks!


M G




More information about the Linux-audit mailing list