Audit rule questions

[Fulda, Paul (Mission Systems)]

All,

Is there a way to set a rule to watch particular files in a directory
like /etc/*?  Can you use wildcards in the rules?

Also, is there a way to set a rule to grab just non-root user actions on
a file?

Thanks!
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://listman.redhat.com/archives/linux-audit/attachments/20070102/eb1428a5/attachment.htm>