Qusetion on logging file deletions with auditd

[Steve Grubb]

On Tuesday 30 January 2007 20:49, Walt Powell wrote:
> What would the appropriate syscall be in the audit.rules file to log file
> deletions with auditd?

Assuming current upstream kernel...In terms of watches, I think deletion is 
considered a write. But if you audit writes like this:

auditctl -w /var/log/messages -p w -k delete-logs

you will likely get more than you asked for. So, you could do it this way:

auditctl -a exit,always -S unlink -F path=/var/log/messages -F key=delete-logs

and then find them with:

ausearch --start today -k delete-logs

-Steve