On Wednesday 02 November 2005 17:11, Amy Griffis wrote: > So, something like this already works today: > > auditctl -a exit,always -S rename -S rmdir -S unlink -F inode=1234 Gotcha. I updated the man page. This answers all my questions for now. Looking forward to the patches... :) -Steve