On Thursday, October 08, 2015 01:32:16 PM Bond Masuda wrote: > with linux audit, how do I monitor the deletion of directories? I am > already monitoring the unlink syscall, but it only seems to monitor > deleted files. There is a rmdir syscall. Add that to your rule. -Steve