From mboxrd@z Thu Jan 1 00:00:00 1970 From: Steve Subject: File watching Date: Tue, 20 Jun 2006 13:53:14 -0400 Message-ID: <4498360A.7090807@ornl.gov> Mime-Version: 1.0 Content-Type: text/plain; charset=ISO-8859-1; format=flowed Content-Transfer-Encoding: 7bit Return-path: Received: from mx3.redhat.com (mx3.redhat.com [172.16.48.32]) by int-mx1.corp.redhat.com (8.12.11.20060308/8.12.11) with ESMTP id k5KHrVC9030293 for ; Tue, 20 Jun 2006 13:53:31 -0400 Received: from emroute4.ornl.gov (emroute4.ornl.gov [160.91.86.27]) by mx3.redhat.com (8.13.1/8.13.1) with ESMTP id k5KHrJlq017848 for ; Tue, 20 Jun 2006 13:53:25 -0400 Received: from emroute4.ornl.gov (localhost [127.0.0.1]) by emroute4.ornl.gov (PMDF V6.2-1x9 #31038) with ESMTP id <0J1600B7U70UZ8@emroute4.ornl.gov> for linux-audit@redhat.com; Tue, 20 Jun 2006 13:53:19 -0400 (EDT) Received: from ORNLEXCHANGE.ornl.gov (ornlexchange2.ornl.gov [160.91.1.22]) by emroute4.ornl.gov (PMDF V6.2-1x9 #31038) with ESMTP id <0J1600BA070URP@emroute4.ornl.gov> for linux-audit@redhat.com; Tue, 20 Jun 2006 13:53:18 -0400 (EDT) List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Sender: linux-audit-bounces@redhat.com Errors-To: linux-audit-bounces@redhat.com To: linux-audit@redhat.com List-Id: linux-audit@redhat.com I have audit set to monitor all system calls for a file. I see some system calls for it, but I think some may be missing... If I create the file using vi, I only see an open followed by a stat64. Shouldn't there be a write of some type? stat and open can't write to a file, can they? Thanks, Steve