Identifying writes to NFS

Steve Grubb sgrubb at redhat.com
Wed May 30 18:11:51 UTC 2007


On Wednesday 30 May 2007 14:11, Matthew Booth wrote:
> Actually I would be matching on this in an external system. That system
> would receive *all* open() calls. It just needs to be able to
> differentiate nfs from non-nfs.

Ok, I thought you wanted to audit by file system type and have the kernel 
distinguish it. If its external/post-processing, Al gave you the answer.

-Steve




More information about the Linux-audit mailing list