[Date Prev][Date Next]   [Thread Prev][Thread Next]   [Thread Index] [Date Index] [Author Index]

auditctl: how do I remove a watch?



Per the man page, to remove a watch, do the following:
 -W path
Remove a watch for the file system object at path.

However, I get the following:
# auditctl -l
LIST_RULES: exit,always watch=/etc/hosts perm=rwa key=hosts-file
LIST_RULES: exit,always watch=/etc/resolv.conf perm=wa key=resolv
# auditctl -W /etc/hosts
Error sending delete rule data request (No such file or directory)

What am I doing wrong?

[Date Prev][Date Next]   [Thread Prev][Thread Next]   [Thread Index] [Date Index] [Author Index]