On Friday 05 September 2008 19:34:24 Brian LaMere wrote: This rule translates to: auditctl -a always,exit -F dir=/testdir/checkdir -F perm=rwxa -k missingfiles This watches any *files* in the /testdir/checkdir directory and it's subdirectories. To check the directory itself, you need to use the "path" field to point at the directory and not the files it contains. [root ~]# mkdir temp [root ~]# auditctl -a exit,always -F path=/root/temp -F perm=wa -k rm [root ~]# rmdir temp/ [root ~]# ausearch --start recent -k rm time->Sat Sep 6 18:30:10 2008 node=127.0.0.1 type=PATH msg=audit(1220740210.750:906): item=1 name="temp/" inode=13664599 dev=08:08 mode=040755 ouid=0 ogid=0 rdev=00:00 obj=unconfined_u:object_r:user_home_t:s0 node=127.0.0.1 type=PATH msg=audit(1220740210.750:906): item=0 name="/root" inode=13664257 dev=08:08 mode=040750 ouid=0 ogid=0 rdev=00:00 obj=system_u:object_r:user_home_dir_t:s0 node=127.0.0.1 type=CWD msg=audit(1220740210.750:906): cwd="/root" node=127.0.0.1 type=SYSCALL msg=audit(1220740210.750:906): arch=c000003e syscall=84 success=yes exit=0 a0=7fff777e189e a1=2 a2=3960b66114 a3=3960b67a70 items=2 ppid=3621 pid=3940 auid=4325 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=pts1 ses=2 comm="rmdir" exe="/bin/rmdir" subj=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 key="rm" -Steve