auditd for removable media/harddisks

[foo at mailbox.org]

Hi,

I want to track file writes on a removable harddisk:

$ mount
...
/dev/sda9 on /mnt/volatile_folder type ext4 (rw)
...
$ cat /etc/audit/audit.rules
...
-w /mnt/volatile_folder -p w -k folder
...

External processes regularly unmount, format and mount /dev/sda9. Currently unmounting the device stops the auditd volatile_folder watcher and I have to restart auditd. Is there a better way?

Thx + Best
Fir

-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://listman.redhat.com/archives/linux-audit/attachments/20201130/e2283d06/attachment.htm>