From mboxrd@z Thu Jan  1 00:00:00 1970
From: Richard Maciel <rmaciel@linux.vnet.ibm.com>
Subject: audit file creation/deletion
Date: Mon, 10 May 2010 10:36:06 -0300
Message-ID: <4BE80BC6.60607@linux.vnet.ibm.com>
Mime-Version: 1.0
Content-Type: text/plain; charset="us-ascii"; Format="flowed"
Content-Transfer-Encoding: 7bit
Return-path: <linux-audit-bounces@redhat.com>
Received: from mx1.redhat.com (ext-mx05.extmail.prod.ext.phx2.redhat.com
	[10.5.110.9])
	by int-mx03.intmail.prod.int.phx2.redhat.com (8.13.8/8.13.8) with ESMTP
	id o4ADahhb032438
	for <linux-audit@redhat.com>; Mon, 10 May 2010 09:36:43 -0400
Received: from e6.ny.us.ibm.com (e6.ny.us.ibm.com [32.97.182.146])
	by mx1.redhat.com (8.13.8/8.13.8) with ESMTP id o4ADaW6O009226
	for <linux-audit@redhat.com>; Mon, 10 May 2010 09:36:33 -0400
Received: from d01relay05.pok.ibm.com (d01relay05.pok.ibm.com [9.56.227.237])
	by e6.ny.us.ibm.com (8.14.3/8.13.1) with ESMTP id o4ADYUXi011310
	for <linux-audit@redhat.com>; Mon, 10 May 2010 09:34:30 -0400
Received: from d03av06.boulder.ibm.com (d03av06.boulder.ibm.com [9.17.195.245])
	by d01relay05.pok.ibm.com (8.13.8/8.13.8/NCO v10.0) with ESMTP id
	o4ADaVQV119678
	for <linux-audit@redhat.com>; Mon, 10 May 2010 09:36:31 -0400
Received: from d03av06.boulder.ibm.com (loopback [127.0.0.1])
	by d03av06.boulder.ibm.com (8.14.3/8.13.1/NCO v10.0 AVout) with ESMTP
	id o4ADdIFm026567
	for <linux-audit@redhat.com>; Mon, 10 May 2010 07:39:18 -0600
Received: from [9.18.235.85] ([9.18.235.85])
	by d03av06.boulder.ibm.com (8.14.3/8.13.1/NCO v10.0 AVin) with ESMTP id
	o4ADdH4V026533
	for <linux-audit@redhat.com>; Mon, 10 May 2010 07:39:17 -0600
List-Unsubscribe: <https://www.redhat.com/mailman/options/linux-audit>,
	<mailto:linux-audit-request@redhat.com?subject=unsubscribe>
List-Archive: <https://www.redhat.com/archives/linux-audit>
List-Post: <mailto:linux-audit@redhat.com>
List-Help: <mailto:linux-audit-request@redhat.com?subject=help>
List-Subscribe: <https://www.redhat.com/mailman/listinfo/linux-audit>,
	<mailto:linux-audit-request@redhat.com?subject=subscribe>
Sender: linux-audit-bounces@redhat.com
Errors-To: linux-audit-bounces@redhat.com
To: linux-audit@redhat.com
List-Id: linux-audit@redhat.com

Is it possible to audit only the events of creation and deletion of files?

I know that I can use a watch rule with a write filter to check if a 
file or directory is being created/delete, but this rule also generates 
audit entries when a file (inside the directory being tracked) is 
modified. Is there a way to prevent this?

Best Regards,
-- 
Richard Maciel, MSc
IBM Linux Technology Center
rmaciel@linux.vnet.ibm.com