* Exclusion with recursive watch
@ 2009-02-19 15:30 Ameel Kamboh
2009-02-19 18:43 ` Steve Grubb
0 siblings, 1 reply; 2+ messages in thread
From: Ameel Kamboh @ 2009-02-19 15:30 UTC (permalink / raw)
To: linux-audit
[-- Attachment #1.1: Type: text/plain, Size: 333 bytes --]
I am currently using audit-1.6.5-9.el5.
I have watch rules that look for modifications to directory content,
example:
-w /etc -p aw
I would like to add an exception not to watch "/etc/mydir".
I know that audit 1.6 will watch /etc and all subdirs within that.
Is there a way I can add this exception?
Thanks
Ameel
[-- Attachment #1.2: Type: text/html, Size: 1025 bytes --]
[-- Attachment #2: Type: text/plain, Size: 0 bytes --]
^ permalink raw reply [flat|nested] 2+ messages in thread* Re: Exclusion with recursive watch
2009-02-19 15:30 Exclusion with recursive watch Ameel Kamboh
@ 2009-02-19 18:43 ` Steve Grubb
0 siblings, 0 replies; 2+ messages in thread
From: Steve Grubb @ 2009-02-19 18:43 UTC (permalink / raw)
To: linux-audit
On Thursday 19 February 2009 10:30:05 am Ameel Kamboh wrote:
> -w /etc -p aw
>
> I would like to add an exception not to watch "/etc/mydir".
> I know that audit 1.6 will watch /etc and all subdirs within that.
> Is there a way I can add this exception?
Not today. That is a kernel issue. Al corrected this in a patch that should
have landed in the 2.6.29 kernel. I believe this will also be fixed in the
next RHEL kernel.
-Steve
^ permalink raw reply [flat|nested] 2+ messages in thread
end of thread, other threads:[~2009-02-19 18:43 UTC | newest]
Thread overview: 2+ messages (download: mbox.gz follow: Atom feed
-- links below jump to the message on this page --
2009-02-19 15:30 Exclusion with recursive watch Ameel Kamboh
2009-02-19 18:43 ` Steve Grubb
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox