auditing automounted filesystems (NFS)

Frank Thommen f.thommen at dkfz-heidelberg.de
Sat Apr 7 02:04:00 UTC 2018


Hello,

we have started auditing on our systems (file open, close, write etc.). 
This is no problem on local and on statically mounted NFS systems (-a 
exit,always -F dir=/a/b/c ...).  However for automounted filesystems 
auditd only reports on system calls on those filesystems which are 
mounted when auditd starts.

Is there a way to make auditd aware of newly mounted NFS filesystems, so 
that we can audit them, too?

Cheers
frank




More information about the Linux-audit mailing list