[Date Prev][Date Next]   [Thread Prev][Thread Next]   [Thread Index] [Date Index] [Author Index]

Re: File system audit loses watches



On Tue, 2005-06-07 at 13:33 -0400, Steve Grubb wrote:
> Looking through the audit logs, the is one CONFIG_CHANGE record with watch 
> insert. No records with watch remove. The removal of a rule is a config 
> change and should have a corresponding audit event. But...rules should never 
> be lost unless they are explicitly deleted by the admin should they?

Same answer as last time you asked the question. The rule is tied to the
directory, and when the directory goes away the watch does too.

-- 
dwmw2



[Date Prev][Date Next]   [Thread Prev][Thread Next]   [Thread Index] [Date Index] [Author Index]