file watch question

[LC Bruzenak]

On 08/16/2013 03:19 PM, LC Bruzenak wrote:
> The line saying, "Unlike most syscall auditing rules, watches do not
> impact performance based on the number of rules sent to the kernel" -
> does this mean that BOTH the "-w" and "syscall" rules have no
> performance impact?
>
> Thx,
> LCB
>
Nevermind; I see that the rule in force (with auditctl -l) is the same
regardless of the way it is specified in the auditctl line.

Thx,
LCB

-- 
LC (Lenny) Bruzenak
lenny at magitekltd.com