Re: file watch question
On 08/16/2013 03:19 PM, LC Bruzenak wrote:
The line saying, "Unlike most syscall auditing rules, watches do
not
impact performance based on the number of rules sent to the kernel" -
does this mean that BOTH the "-w" and "syscall" rules have no
performance impact?
Thx,
LCB
Nevermind; I see that the rule in force (with auditctl -l) is the same
regardless of the way it is specified in the auditctl line.
Thx,
LCB
--
LC (Lenny) Bruzenak
lenny(a)magitekltd.com