Qusetion on logging file deletions with auditd

[Walt Powell]

What would the appropriate syscall be in the audit.rules file to log file deletions with auditd?  I'm thinking the syntax would be something akin to -w entry, always -S delete, but that doesn't seem to work...

Thanks to all...
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://listman.redhat.com/archives/linux-audit/attachments/20070130/687c0efd/attachment.htm>