From mboxrd@z Thu Jan 1 00:00:00 1970 From: "Walt Powell" Subject: Qusetion on logging file deletions with auditd Date: Tue, 30 Jan 2007 20:49:36 -0500 Message-ID: <000e01c744da$112dec10$6400a8c0@powerbox> Mime-Version: 1.0 Content-Type: multipart/mixed; boundary="===============1217936565==" Return-path: Received: from mx1.redhat.com (mx1.redhat.com [172.16.48.31]) by int-mx1.corp.redhat.com (8.13.1/8.13.1) with ESMTP id l0V1nlnk007748 for ; Tue, 30 Jan 2007 20:49:47 -0500 Received: from ms-smtp-02.ohiordc.rr.com (ms-smtp-02.ohiordc.rr.com [65.24.5.136]) by mx1.redhat.com (8.13.1/8.13.1) with ESMTP id l0V1nh1Y018755 for ; Tue, 30 Jan 2007 20:49:43 -0500 Received: from powerbox (cpe-65-189-170-115.columbus.res.rr.com [65.189.170.115]) by ms-smtp-02.ohiordc.rr.com (8.13.6/8.13.6) with SMTP id l0V1nbGK008759 for ; Tue, 30 Jan 2007 20:49:37 -0500 (EST) List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Sender: linux-audit-bounces@redhat.com Errors-To: linux-audit-bounces@redhat.com To: linux-audit@redhat.com List-Id: linux-audit@redhat.com This is a multi-part message in MIME format. --===============1217936565== Content-Type: multipart/alternative; boundary="----=_NextPart_000_000B_01C744B0.27634AE0" This is a multi-part message in MIME format. ------=_NextPart_000_000B_01C744B0.27634AE0 Content-Type: text/plain; charset="iso-8859-1" Content-Transfer-Encoding: quoted-printable What would the appropriate syscall be in the audit.rules file to log = file deletions with auditd? I'm thinking the syntax would be something = akin to -w entry, always -S delete, but that doesn't seem to work... Thanks to all... ------=_NextPart_000_000B_01C744B0.27634AE0 Content-Type: text/html; charset="iso-8859-1" Content-Transfer-Encoding: quoted-printable

What would the appropriate syscall be = in the=20 audit.rules file to log file deletions with auditd? I'm = thinking the=20 syntax would be something akin to -w entry, always -S delete, but that = doesn't=20 seem to work...

Thanks to = all...

------=_NextPart_000_000B_01C744B0.27634AE0-- --===============1217936565== Content-Type: text/plain; charset="us-ascii" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit Content-Disposition: inline --===============1217936565==--