I have been using Audit's file watching ability to monitor when files are opened. I decided to also try to monitor the deletion of files, so I told audit to watch for all syscalls pertaining to a particular file. I then tried opening the file, it worked as before. Then I tried to delete the file using 'rm /tmp/test.c' the file was deleted from the filesystem, but audit only showed two syscalls being performed: lstat64 and access. Audit also sent a message saying: ... audit updated rules specifying watch="/tmp/test.c" ... lstat64 and access can not delete files on the filesystem, can they? I expected to see unlink... Any ideas? Steve Jun 14 13:21:06 otslab11 user_actions[8035]: type=1300, payload size=279 Jun 14 13:21:06 otslab11 user_actions[8035]: data="audit(1150305665.265:679): arch=40000003 syscall=196 success=yes exit=0 a0=bf8c7c49 a1=bf8c6fbc a2=8f1ff4 a3=bf8c7c49 items=1 ppid=7838 pid=8043 auid=500 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=pts2 comm="rm" exe="/bin/rm" subj=user_u:system_r:unconfined_t:s0" Jun 14 13:21:06 otslab11 user_actions[8035]: type=1307, payload size=43 Jun 14 13:21:06 otslab11 user_actions[8035]: data="audit(1150305665.265:679): cwd="/tmp/test"" Jun 14 13:21:06 otslab11 user_actions[8035]: type=1302, payload size=143 Jun 14 13:21:06 otslab11 user_actions[8035]: data="audit(1150305665.265:679): item=0 name="/tmp/test.c" inode=5358237 dev=03:02 mode=0100644 ouid=0 ogid=0 rdev=00:00 obj=user_u:object_r:tmp_t:s0" Jun 14 13:21:06 otslab11 user_actions[8035]: type=1300, payload size=264 Jun 14 13:21:06 otslab11 user_actions[8035]: data="audit(1150305665.265:680): arch=40000003 syscall=33 success=yes exit=0 a0=bf8c7c49 a1=2 a2=8f1ff4 a3=2 items=1 ppid=7838 pid=8043 auid=500 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=pts2 comm="rm" exe="/bin/rm" subj=user_u:system_r:unconfined_t:s0" Jun 14 13:21:06 otslab11 user_actions[8035]: type=1307, payload size=43 Jun 14 13:21:06 otslab11 user_actions[8035]: data="audit(1150305665.265:680): cwd="/tmp/test"" Jun 14 13:21:06 otslab11 user_actions[8035]: type=1302, payload size=143 Jun 14 13:21:06 otslab11 user_actions[8035]: data="audit(1150305665.265:680): item=0 name="/tmp/test.c" inode=5358237 dev=03:02 mode=0100644 ouid=0 ogid=0 rdev=00:00 obj=user_u:object_r:tmp_t:s0" Jun 14 13:21:06 otslab11 user_actions[8035]: type=1305, payload size=113 Jun 14 13:21:06 otslab11 user_actions[8035]: data="audit(1150305665.265:681): audit updated rules specifying watch="/tmp/test.c" with dev=4294967295 ino=4294967295 "