On Apr 21, 2014, at 11:28 AM, Steve Grubb <sgrubb@redhat.com> wrote:
What happens is that the text path that you put in a watch is a human convenience. The kernel doesn't understand strings, it understands numbers. It changes the path into device and inode information.
Cool. So I am guessing the rule works even if someone creates a hard link to the same watched path and access files through that other path?