From mboxrd@z Thu Jan 1 00:00:00 1970 From: Marcelo Cerri Subject: Re: Disabling monitoring of a subfolder Date: Mon, 28 Nov 2011 13:48:37 -0200 Message-ID: <4ED3AD55.6060301@linux.vnet.ibm.com> References: Mime-Version: 1.0 Content-Type: text/plain; charset="us-ascii"; Format="flowed" Content-Transfer-Encoding: 7bit Return-path: Received: from mx1.redhat.com (ext-mx13.extmail.prod.ext.phx2.redhat.com [10.5.110.18]) by int-mx10.intmail.prod.int.phx2.redhat.com (8.14.4/8.14.4) with ESMTP id pASFmjvs016187 for ; Mon, 28 Nov 2011 10:48:45 -0500 Received: from e24smtp05.br.ibm.com (e24smtp05.br.ibm.com [32.104.18.26]) by mx1.redhat.com (8.14.4/8.14.4) with ESMTP id pASFmh61028057 for ; Mon, 28 Nov 2011 10:48:43 -0500 Received: from /spool/local by e24smtp05.br.ibm.com with IBM ESMTP SMTP Gateway: Authorized Use Only! Violators will be prosecuted for from ; Mon, 28 Nov 2011 13:48:42 -0200 Received: from d24av02.br.ibm.com (d24av02.br.ibm.com [9.8.31.93]) by d24relay01.br.ibm.com (8.13.8/8.13.8/NCO v10.0) with ESMTP id pASFkABs3276816 for ; Mon, 28 Nov 2011 12:46:10 -0300 Received: from d24av02.br.ibm.com (loopback [127.0.0.1]) by d24av02.br.ibm.com (8.14.4/8.13.1/NCO v10.0 AVout) with ESMTP id pASFmbW1027240 for ; Mon, 28 Nov 2011 13:48:37 -0200 Received: from oc8526070481.ibm.com (dhcp-9-18-235-22.br.ibm.com [9.18.235.22]) by d24av02.br.ibm.com (8.14.4/8.13.1/NCO v10.0 AVin) with ESMTP id pASFmbTe027232 for ; Mon, 28 Nov 2011 13:48:37 -0200 In-Reply-To: List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Sender: linux-audit-bounces@redhat.com Errors-To: linux-audit-bounces@redhat.com To: linux-audit@redhat.com List-Id: linux-audit@redhat.com Hi, You could use a syscall based form to write the rule. First exclude the subdirectory that you don't want to watch (using *never* as action): auditctl -a exit,never -F dir=/var/mydata/tmp_data -k my-data And then add a watcher to all the rest: auditctl -a exit,always -F dir=/var/mydata -F perm=w -k my-data Regards, Marcelo On 11/24/2011 12:46 PM, Marina Gray wrote: > I have a folder which I'd like to monitor with auditd, with the > exception of one specific subdirectory. Is there any way I can disable > monitoring just that subdirectory, but keep monitoring the rest of the > dir recursively as usual? > > Say, I first do: > > auditctl -w /var/mydata/ -k my-data -p w > > and want to exclude looking at /var/mydata/tmp_data/ > > > Thanks! > > > M G > > -- > Linux-audit mailing list > Linux-audit@redhat.com > https://www.redhat.com/mailman/listinfo/linux-audit >