[Date Prev][Date Next]   [Thread Prev][Thread Next]   [Thread Index] [Date Index] [Author Index]

command missing



Hi,

I've just started using auditing utilities to monitor filesystem events. I'm using audit-1.5.2
version. The problem is as follows:

If I do "auditctl -a entry,always -w /etc/passwd", then "grep man /etc/passwd", then "ausearch -f
passwd", the "grep" command is logged in the log file.

However, if I do "auditctl -a entry,always -w /etc", then "grep man /etc/passwd", then "ausearch -f 
passwd", the "grep" command is not logged in the log file. However, the "vim" command is recorded
if I use vim to open that "/etc/passwd" file.

Is this the preassumed behavior for the auditing system or have I misconfigured something? Any
clues on that?

ps: Is there a better way to monitor the whole filesystem behaviors, such as open, create, delete
syscalls, instead of just monitoring a single directory?

Thanks for your help,

Xi




[Date Prev][Date Next]   [Thread Prev][Thread Next]   [Thread Index] [Date Index] [Author Index]