[CentOS] Watching a file using auditd

Fri Apr 2 22:53:52 UTC 2010
Yungwei Chen <yungwei at resolvity.com>


I am using auditd to monitor files for changes (read and write actually).
I found that when auditd is running, it will correctly report files that are read, but will not report changes to a file that is being monitored.
But if I stop auditd and load audit rules using auditctl, it will work as expected.

Here's the audit rule:
-w /tmp/audit-test -p rw -k __monitored__

What am I missing here? Thanks.