nevermind; I found "man auditctl" and I think I can piece the two together. -------------- next part -------------- An HTML attachment was scrubbed... URL: <http://listman.redhat.com/archives/linux-audit/attachments/20121115/f7d12700/attachment.htm>