"Watch"ing a directory

Pete Briggs pbriggs at ll.mit.edu
Wed Aug 22 14:17:37 UTC 2007


Is there any way to put a watch on a directory, so that an audit record
will be generated if anyone cd's to that directory. I've tried things
like:

-w /etc/audit/ -k ACCESS_AUDIT

but the rule never seems to get invoked. I'm running FC7 with
audit-1.5.3

Thanks for any help
- Pete Briggs





More information about the Linux-audit mailing list