Bypassing audit's file watches