From mboxrd@z Thu Jan 1 00:00:00 1970 From: Sankarshan Mukhopadhyay Subject: Re: "Watch"ing a directory Date: Wed, 22 Aug 2007 20:10:11 +0530 Message-ID: <46CC4ACB.8020904@gmail.com> References: <6F2A8C9C4C5BE446A17B745BBC856EEB5A6D37@XMBTX113.northgrum.com> <200708211150.46895.sgrubb@redhat.com> <6F2A8C9C4C5BE446A17B745BBC856EEB5A6D3E@XMBTX113.northgrum.com> <200708211416.45503.sgrubb@redhat.com> <6F2A8C9C4C5BE446A17B745BBC856EEB5A6D41@XMBTX113.northgrum.com> <1187792258.3151.108.camel@prudence.llan.ll.mit.edu> Mime-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 7bit Return-path: In-Reply-To: <1187792258.3151.108.camel@prudence.llan.ll.mit.edu> List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Sender: linux-audit-bounces@redhat.com Errors-To: linux-audit-bounces@redhat.com To: pbriggs@ll.mit.edu Cc: linux-audit@redhat.com List-Id: linux-audit@redhat.com -----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 Pete Briggs wrote: > Is there any way to put a watch on a directory, so that an audit record > will be generated if anyone cd's to that directory. I've tried things > like: > > -w /etc/audit/ -k ACCESS_AUDIT > > but the rule never seems to get invoked. I'm running FC7 with > audit-1.5.3 Let me add to this question ? Is it feasible to watch a top level directory recursively ? ie say /opt and not /opt/mydir/mymoredir/ etc ? - -- You see things; and you say 'Why?'; But I dream things that never were; and I say 'Why not?' - George Bernard Shaw -----BEGIN PGP SIGNATURE----- Version: GnuPG v1.4.7 (GNU/Linux) Comment: Using GnuPG with Fedora - http://enigmail.mozdev.org iD8DBQFGzErKXQZpNTcrCzMRAg3RAJ9x665sUBd5hzRjdX3x/g3bGdk6eACgpQn9 Wueth9+1jtrA+1S/za0qsgY= =qowH -----END PGP SIGNATURE-----