Matthew Booth wrote: every Okay, that's valuable, but I see I did not describe my problem precisely enough. Let me try this again. How do I configure parameters for auditctl to make an audit record every time a PARTICULAR file is executed? Is there a way to do this? Or is the only way to report on this information by collecting auditing for all executed files (as given, above), and then to filter more accurately using "ausearch -f filename"? -- Bill

Steve Grubb wrote: Thanks Steve. I completely overlooked the example files. -- Bill