File system audit loses watches

Steve Grubb sgrubb at redhat.com
Tue Jun 7 20:42:18 UTC 2005


On Tuesday 07 June 2005 16:34, David Woodhouse wrote:
> Same answer as last time you asked the question. The rule is tied to the
> directory, and when the directory goes away the watch does too.

I asked again because we still have a problem. If the configuration changes, I 
think there has to be a CONFIG_CHANGED record.

-Steve




More information about the Linux-audit mailing list