Re: Excluding events by command

> my patch only allows for positive match, not negative matching. I was > afraid someone saying something like, '-a exit,always -S open -F > exe!=/bin/bash' but I suppose like any audit rule, it could be a > caveat emptor sort of thing. > > I'll modify that patch and resend it, but it doesn't help the current > situation. I was thinking something like -a exit,never -S open -F exe=/bin/bash