How to exclude directories from auditing?

public inbox for linux-audit@redhat.com
 help / color / mirror / Atom feed

* How to exclude directories from auditing?
@ 2013-10-25 10:28 Leam Hall
  2013-10-25 12:44 ` Steve Grubb
  0 siblings, 1 reply; 2+ messages in thread
From: Leam Hall @ 2013-10-25 10:28 UTC (permalink / raw)
  To: linux-audit

I know you can specify certain directories to watch. Is there a way to 
exclude sub-directories?

Pointers to docs are appreciated; I have a lot to learn!

Thanks!

Leam

-- 
http://31challenge.net
http://31challenge.net/insight

^ permalink raw reply	[flat|nested] 2+ messages in thread

* Re: How to exclude directories from auditing?
  2013-10-25 10:28 How to exclude directories from auditing? Leam Hall
@ 2013-10-25 12:44 ` Steve Grubb
  0 siblings, 0 replies; 2+ messages in thread
From: Steve Grubb @ 2013-10-25 12:44 UTC (permalink / raw)
  To: linux-audit

On Friday, October 25, 2013 06:28:23 AM Leam Hall wrote:
> I know you can specify certain directories to watch. Is there a way to
> exclude sub-directories?
> 
> Pointers to docs are appreciated; I have a lot to learn!

Something like this should work:
-a never,exit -F dir=/var

Remember first match wins. Exclusions should come before other rules.

-Steve

^ permalink raw reply	[flat|nested] 2+ messages in thread

end of thread, other threads:[~2013-10-25 12:44 UTC | newest]

Thread overview: 2+ messages (download: mbox.gz follow: Atom feed
-- links below jump to the message on this page --
2013-10-25 10:28 How to exclude directories from auditing? Leam Hall
2013-10-25 12:44 ` Steve Grubb

This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox