AUDIT Rules

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA256 Can someone tell me what is the correct syntax for successfully or failing to modify a file using the chmod command? I have : - -a exit,possible -S chmod -F success=0 -F success!=0 - -a exit,possible -S fchmod -F success=0 -F success!=0 But I am not able to audit the event. As a regular user I try to change the permissions of /etc/shadow. The action fails (as expected) but does not get audited. Any suggestions is greatly appreciated. Paul Whitney Information Systems Solutions paul.whitney(a)mac.com