auditing automounted filesystems (NFS)
Frank Thommen
f.thommen at dkfz-heidelberg.de
Sat Apr 7 02:04:00 UTC 2018
Hello,
we have started auditing on our systems (file open, close, write etc.).
This is no problem on local and on statically mounted NFS systems (-a
exit,always -F dir=/a/b/c ...). However for automounted filesystems
auditd only reports on system calls on those filesystems which are
mounted when auditd starts.
Is there a way to make auditd aware of newly mounted NFS filesystems, so
that we can audit them, too?
Cheers
frank
More information about the Linux-audit
mailing list