Re: RHEL 4, Auditing
On Tuesday, July 20, 2010 08:04:02 am List Quest wrote:
I trying RHEL 4.x series auditing.
Example:
Audit version: audit-1.0.15-3.EL4
-w /root -p w
config line added to audit.rules; but this config watch only "/root"
directory writes. Do not watch "/root/Desktop", "/root/test", etc...
I can't recusive directory watch; like audit version audit-1.7.17-3
How this?
That is correct. The first iteration of the audit system has some limitations
that were fixed over time. For example, another thing you cannot do on the
older kernels is add a key to syscall rules.
-Steve