Re: AUDIT Rules
On Wednesday 23 May 2007 15:04, Paul Whitney wrote:
-a exit,possible -S chmod -F success=0 -F success!=0
-a exit,possible -S fchmod -F success=0 -F success!=0
-a exit,always -S chmod -S fchmod -F success=0
You can combine the syscalls into 1 rule.
-Steve