* audit file creation/deletion
@ 2010-05-10 13:36 Richard Maciel
0 siblings, 0 replies; only message in thread
From: Richard Maciel @ 2010-05-10 13:36 UTC (permalink / raw)
To: linux-audit
Is it possible to audit only the events of creation and deletion of files?
I know that I can use a watch rule with a write filter to check if a
file or directory is being created/delete, but this rule also generates
audit entries when a file (inside the directory being tracked) is
modified. Is there a way to prevent this?
Best Regards,
--
Richard Maciel, MSc
IBM Linux Technology Center
rmaciel@linux.vnet.ibm.com
^ permalink raw reply [flat|nested] only message in thread
only message in thread, other threads:[~2010-05-10 13:36 UTC | newest]
Thread overview: (only message) (download: mbox.gz follow: Atom feed
-- links below jump to the message on this page --
2010-05-10 13:36 audit file creation/deletion Richard Maciel
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.