From mboxrd@z Thu Jan  1 00:00:00 1970
From: Vincas Dargis <vindrg@gmail.com>
Subject: Excluding stat syscall logging for specific path
Date: Fri, 29 Apr 2016 20:56:26 +0300
Message-ID: <5723A04A.6080208@gmail.com>
Mime-Version: 1.0
Content-Type: text/plain; charset="us-ascii"; Format="flowed"
Content-Transfer-Encoding: 7bit
Return-path: <linux-audit-bounces@redhat.com>
Received: from mx1.redhat.com (ext-mx05.extmail.prod.ext.phx2.redhat.com
	[10.5.110.29])
	by int-mx11.intmail.prod.int.phx2.redhat.com (8.14.4/8.14.4) with ESMTP
	id u3THuUtZ021412
	(version=TLSv1/SSLv3 cipher=DHE-RSA-AES256-GCM-SHA384 bits=256
	verify=NO)
	for <linux-audit@redhat.com>; Fri, 29 Apr 2016 13:56:30 -0400
Received: from mail-wm0-f45.google.com (mail-wm0-f45.google.com [74.125.82.45])
	(using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits))
	(No client certificate requested)
	by mx1.redhat.com (Postfix) with ESMTPS id CF90837E81
	for <linux-audit@redhat.com>; Fri, 29 Apr 2016 17:56:28 +0000 (UTC)
Received: by mail-wm0-f45.google.com with SMTP id n129so37071800wmn.1
	for <linux-audit@redhat.com>; Fri, 29 Apr 2016 10:56:28 -0700 (PDT)
Received: from [192.168.0.10] (ip-77-221-87-116.kava.lt. [77.221.87.116])
	by smtp.gmail.com with ESMTPSA id 186sm4414345wmk.2.2016.04.29.10.56.26
	for <linux-audit@redhat.com>
	(version=TLS1_2 cipher=ECDHE-RSA-AES128-GCM-SHA256 bits=128/128);
	Fri, 29 Apr 2016 10:56:27 -0700 (PDT)
List-Unsubscribe: <https://www.redhat.com/mailman/options/linux-audit>,
	<mailto:linux-audit-request@redhat.com?subject=unsubscribe>
List-Archive: <https://www.redhat.com/archives/linux-audit>
List-Post: <mailto:linux-audit@redhat.com>
List-Help: <mailto:linux-audit-request@redhat.com?subject=help>
List-Subscribe: <https://www.redhat.com/mailman/listinfo/linux-audit>,
	<mailto:linux-audit-request@redhat.com?subject=subscribe>
Sender: linux-audit-bounces@redhat.com
Errors-To: linux-audit-bounces@redhat.com
To: linux-audit@redhat.com
List-Id: linux-audit@redhat.com

Hi,

When playing/learning with auditd, I wanted to log events when apache fails to access file.

Here's the rules I used in Debian Wheezy (same on Jessie and and current latest Testing):

-a exit,never -F arch=b64 -S stat -F path=/var/www/server-status -k web
-a exit,always -F arch=b64 -S stat -F uid=www-data -F success=0 -k web

/var/www/server-status file is non-existant, it's just alias for accessing mod_status information ( 
http://.../server-status path is accessed by munin regularly) so I wanted to minimise noise by that exit,never rule.

But I can't get it work.

I have more in-depth post in Debian forums [1] if that helps, but in short, should this work in general?

Thanks!

[1] http://forums.debian.net/viewtopic.php?f=5&t=128092