Exclusion with recursive watch

[Steve Grubb]

On Thursday 19 February 2009 10:30:05 am Ameel Kamboh wrote:
>     -w  /etc -p aw
>
> I would like to add an exception not to watch "/etc/mydir".
> I know that audit 1.6 will watch /etc and all subdirs within that.
> Is there a way I can add this exception?

Not today. That is a kernel issue. Al corrected this in a patch that should 
have landed in the 2.6.29 kernel. I believe this will also be fixed in the 
next RHEL kernel.

-Steve