* How to exclude directories from auditing?
@ 2013-10-25 10:28 Leam Hall
2013-10-25 12:44 ` Steve Grubb
0 siblings, 1 reply; 2+ messages in thread
From: Leam Hall @ 2013-10-25 10:28 UTC (permalink / raw)
To: linux-audit
I know you can specify certain directories to watch. Is there a way to
exclude sub-directories?
Pointers to docs are appreciated; I have a lot to learn!
Thanks!
Leam
--
http://31challenge.net
http://31challenge.net/insight
^ permalink raw reply [flat|nested] 2+ messages in thread
* Re: How to exclude directories from auditing?
2013-10-25 10:28 How to exclude directories from auditing? Leam Hall
@ 2013-10-25 12:44 ` Steve Grubb
0 siblings, 0 replies; 2+ messages in thread
From: Steve Grubb @ 2013-10-25 12:44 UTC (permalink / raw)
To: linux-audit
On Friday, October 25, 2013 06:28:23 AM Leam Hall wrote:
> I know you can specify certain directories to watch. Is there a way to
> exclude sub-directories?
>
> Pointers to docs are appreciated; I have a lot to learn!
Something like this should work:
-a never,exit -F dir=/var
Remember first match wins. Exclusions should come before other rules.
-Steve
^ permalink raw reply [flat|nested] 2+ messages in thread
end of thread, other threads:[~2013-10-25 12:44 UTC | newest]
Thread overview: 2+ messages (download: mbox.gz follow: Atom feed
-- links below jump to the message on this page --
2013-10-25 10:28 How to exclude directories from auditing? Leam Hall
2013-10-25 12:44 ` Steve Grubb
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).