I have a folder which I'd like to monitor with auditd, with the exception of one specific subdirectory. Is there any way I can disable monitoring just that subdirectory, but keep monitoring the rest of the dir recursively as usual? Say, I first do: auditctl -w /var/mydata/ -k my-data -p w and want to exclude looking at /var/mydata/tmp_data/ Thanks! M G -- Linux-audit mailing list Linux-audit(a)redhat.com https://www.redhat.com/mailman/listinfo/linux-audit