Disabling monitoring of a subfolder
Marina Gray
marina.gray at itselearning.ca
Thu Nov 24 14:46:57 UTC 2011
I have a folder which I'd like to monitor with auditd, with the
exception of one specific subdirectory. Is there any way I can disable
monitoring just that subdirectory, but keep monitoring the rest of the
dir recursively as usual?
Say, I first do:
auditctl -w /var/mydata/ -k my-data -p w
and want to exclude looking at /var/mydata/tmp_data/
Thanks!
M G
More information about the Linux-audit
mailing list