From mboxrd@z Thu Jan  1 00:00:00 1970
From: Steve Grubb <sgrubb@redhat.com>
Subject: Re: Qusetion on logging file deletions with auditd
Date: Mon, 5 Feb 2007 09:07:41 -0500
Message-ID: <200702050907.41290.sgrubb@redhat.com>
References: <000e01c744da$112dec10$6400a8c0@powerbox>
Mime-Version: 1.0
Content-Type: text/plain;
  charset="utf-8"
Content-Transfer-Encoding: 7bit
Return-path: <linux-audit-bounces@redhat.com>
In-Reply-To: <000e01c744da$112dec10$6400a8c0@powerbox>
Content-Disposition: inline
List-Unsubscribe: <https://www.redhat.com/mailman/listinfo/linux-audit>,
	<mailto:linux-audit-request@redhat.com?subject=unsubscribe>
List-Archive: <https://www.redhat.com/archives/linux-audit>
List-Post: <mailto:linux-audit@redhat.com>
List-Help: <mailto:linux-audit-request@redhat.com?subject=help>
List-Subscribe: <https://www.redhat.com/mailman/listinfo/linux-audit>,
	<mailto:linux-audit-request@redhat.com?subject=subscribe>
Sender: linux-audit-bounces@redhat.com
Errors-To: linux-audit-bounces@redhat.com
To: linux-audit@redhat.com
List-Id: linux-audit@redhat.com

On Tuesday 30 January 2007 20:49, Walt Powell wrote:
> What would the appropriate syscall be in the audit.rules file to log file
> deletions with auditd?

Assuming current upstream kernel...In terms of watches, I think deletion is 
considered a write. But if you audit writes like this:

auditctl -w /var/log/messages -p w -k delete-logs

you will likely get more than you asked for. So, you could do it this way:

auditctl -a exit,always -S unlink -F path=/var/log/messages -F key=delete-logs

and then find them with:

ausearch --start today -k delete-logs

-Steve