From mboxrd@z Thu Jan 1 00:00:00 1970 From: Steve Subject: Re: File watching Date: Tue, 20 Jun 2006 14:32:05 -0400 Message-ID: <44983F25.5010801@ornl.gov> References: <4498360A.7090807@ornl.gov> <20060620181024.GA31078@arlut.utexas.edu> <1150827779.19484.7.camel@localhost.localdomain> Mime-Version: 1.0 Content-Type: text/plain; charset=ISO-8859-1; format=flowed Content-Transfer-Encoding: 7bit Return-path: Received: from mx3.redhat.com (mx3.redhat.com [172.16.48.32]) by int-mx1.corp.redhat.com (8.12.11.20060308/8.12.11) with ESMTP id k5KIWG0l011132 for ; Tue, 20 Jun 2006 14:32:16 -0400 Received: from emroute2.ornl.gov (emroute2.ornl.gov [160.91.86.17]) by mx3.redhat.com (8.13.1/8.13.1) with ESMTP id k5KIWAuV030663 for ; Tue, 20 Jun 2006 14:32:10 -0400 Received: from emroute2.ornl.gov (localhost [127.0.0.1]) by emroute2.ornl.gov (PMDF V6.2-1x9 #31038) with ESMTP id <0J1600G808TLQC@emroute2.ornl.gov> for linux-audit@redhat.com; Tue, 20 Jun 2006 14:32:09 -0400 (EDT) Received: from ORNLEXCHANGE.ornl.gov (ornlexchange2.ornl.gov [160.91.1.22]) by emroute2.ornl.gov (PMDF V6.2-1x9 #31038) with ESMTP id <0J1600DD08TLKH@emroute2.ornl.gov> for linux-audit@redhat.com; Tue, 20 Jun 2006 14:32:09 -0400 (EDT) In-reply-to: <1150827779.19484.7.camel@localhost.localdomain> List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Sender: linux-audit-bounces@redhat.com Errors-To: linux-audit-bounces@redhat.com To: linux-audit@redhat.com List-Id: linux-audit@redhat.com >> Instead, you audit the file open, and make a note of whether the file >> was opened read-only, or for read/write. If it was opened for >> read/write, one presumes that it was written to. Is it possible to tell if a file was opened read/write or read-only from the events generated by audit? Thanks, Steve