Re: proposed interface changes for filesystem audit
On Wednesday 02 November 2005 17:11, Amy Griffis wrote:
So, something like this already works today:
auditctl -a exit,always -S rename -S rmdir -S unlink -F inode=1234
Gotcha. I updated the man page.
This answers all my questions for now. Looking forward to the patches... :)
-Steve