Path ignored but syscall event still logged

[Max Williams]

OK, thanks for clarifying Steve. I'll open a support case with RH.
Cheers,
Max

-----Original Message-----
From: Steve Grubb [mailto:sgrubb at redhat.com] 
Sent: 12 January 2012 15:04
To: linux-audit at redhat.com
Cc: Max Williams
Subject: Re: Path ignored but syscall event still logged

On Thursday, January 12, 2012 09:45:59 AM Max Williams wrote:
> Sorry to bug you but is this issue I'm having a bug or have I made a 
> mistake in the rules? Is there another way I could exclude this 
> directory from auditd? We have licenses for these servers so I could 
> open a case if need be.

The preliminary investigation was its a kernel bug. It needs to be checked in more detail to see what the fix is.

-Steve

________________________________________________________________________
In order to protect our email recipients, Betfair Group use SkyScan from 
MessageLabs to scan all Incoming and Outgoing mail for viruses.

________________________________________________________________________