[CentOS] Watching a file using auditd
Yungwei Chen
yungwei at resolvity.comFri Apr 2 22:53:52 UTC 2010
- Previous message: [CentOS] Enlightenment E17 on CentOS 5.x ?
- Next message: [CentOS] (OT) OpenOffice.org calc chart strangeness.
- Messages sorted by: [ date ] [ thread ] [ subject ] [ author ]
Hi, I am using auditd to monitor files for changes (read and write actually). I found that when auditd is running, it will correctly report files that are read, but will not report changes to a file that is being monitored. But if I stop auditd and load audit rules using auditctl, it will work as expected. Here's the audit rule: -w /tmp/audit-test -p rw -k __monitored__ What am I missing here? Thanks.
- Previous message: [CentOS] Enlightenment E17 on CentOS 5.x ?
- Next message: [CentOS] (OT) OpenOffice.org calc chart strangeness.
- Messages sorted by: [ date ] [ thread ] [ subject ] [ author ]
More information about the CentOS mailing list