From mboxrd@z Thu Jan 1 00:00:00 1970 From: Steve Subject: File Monitoring Date: Mon, 24 Jul 2006 12:11:31 -0400 Message-ID: <44C4F133.1000708@ornl.gov> Mime-Version: 1.0 Content-Type: text/plain; charset=ISO-8859-1; format=flowed Content-Transfer-Encoding: 7bit Return-path: Received: from mx1.redhat.com (mx1.redhat.com [172.16.48.31]) by int-mx1.corp.redhat.com (8.12.11.20060308/8.12.11) with ESMTP id k6OGBiIS014485 for ; Mon, 24 Jul 2006 12:11:44 -0400 Received: from emroute3.ornl.gov (emroute3.ornl.gov [160.91.4.110]) by mx1.redhat.com (8.12.11.20060308/8.12.11) with ESMTP id k6OGBg0n007789 for ; Mon, 24 Jul 2006 12:11:43 -0400 Received: from emroute3.ornl.gov (localhost [127.0.0.1]) by emroute3.ornl.gov (PMDF V6.2-1x9 #31038) with ESMTP id <0J2X005IN0ZDPW@emroute3.ornl.gov> for linux-audit@redhat.com; Mon, 24 Jul 2006 12:11:37 -0400 (EDT) Received: from ORNLEXCHANGE.ornl.gov (ornlexchange1.ornl.gov [160.91.1.20]) by emroute3.ornl.gov (PMDF V6.2-1x9 #31038) with ESMTP id <0J2X005G10ZCCM@emroute3.ornl.gov> for linux-audit@redhat.com; Mon, 24 Jul 2006 12:11:36 -0400 (EDT) List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Sender: linux-audit-bounces@redhat.com Errors-To: linux-audit-bounces@redhat.com To: linux-audit@redhat.com List-Id: linux-audit@redhat.com I am monitoring open syscalls on /etc/shadow and am receiving alerts that I would like to suppress. Is it possible to exclude alerts for files opened with particular commands? For example, xlock opening the shadow file? I didn't see an option like this in the auditctl man page, but I know those pages may be outdated. Thanks, Steve