How to exclude directories from auditing?

[Steve Grubb]

On Friday, October 25, 2013 06:28:23 AM Leam Hall wrote:
> I know you can specify certain directories to watch. Is there a way to
> exclude sub-directories?
> 
> Pointers to docs are appreciated; I have a lot to learn!

Something like this should work:
-a never,exit -F dir=/var

Remember first match wins. Exclusions should come before other rules.

-Steve