From mboxrd@z Thu Jan 1 00:00:00 1970 From: LC Bruzenak Subject: Re: file watch question Date: Fri, 16 Aug 2013 16:32:25 -0500 Message-ID: <520E9A69.9030208@magitekltd.com> References: <520E894A.6010403@magitekltd.com> Mime-Version: 1.0 Content-Type: text/plain; charset="us-ascii" Content-Transfer-Encoding: 7bit Return-path: Received: from mx1.redhat.com (ext-mx14.extmail.prod.ext.phx2.redhat.com [10.5.110.19]) by int-mx09.intmail.prod.int.phx2.redhat.com (8.14.4/8.14.4) with ESMTP id r7GLWSL3018927 for ; Fri, 16 Aug 2013 17:32:28 -0400 Received: from mail-ob0-f176.google.com (mail-ob0-f176.google.com [209.85.214.176]) by mx1.redhat.com (8.14.4/8.14.4) with ESMTP id r7GLWRvH004779 for ; Fri, 16 Aug 2013 17:32:27 -0400 Received: by mail-ob0-f176.google.com with SMTP id uz19so2575388obc.7 for ; Fri, 16 Aug 2013 14:32:27 -0700 (PDT) In-Reply-To: <520E894A.6010403@magitekltd.com> List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Sender: linux-audit-bounces@redhat.com Errors-To: linux-audit-bounces@redhat.com To: linux-audit@redhat.com List-Id: linux-audit@redhat.com On 08/16/2013 03:19 PM, LC Bruzenak wrote: > The line saying, "Unlike most syscall auditing rules, watches do not > impact performance based on the number of rules sent to the kernel" - > does this mean that BOTH the "-w" and "syscall" rules have no > performance impact? > > Thx, > LCB > Nevermind; I see that the rule in force (with auditctl -l) is the same regardless of the way it is specified in the auditctl line. Thx, LCB -- LC (Lenny) Bruzenak lenny@magitekltd.com