Disabling monitoring of a subfolder

Marina Gray
2011-11-24T14:46:59Z

I have a folder which I'd like to monitor with auditd, with the
exception of one specific subdirectory. Is there any way I can disable
monitoring just that subdirectory, but keep monitoring the rest of the
dir recursively as usual?

Say, I first do:

auditctl -w /var/mydata/ -k my-data -p w

and want to exclude looking at /var/mydata/tmp_data/

Thanks!

M G