Hi;

Second lack for configuration.

RHEL 5.x can configure one directory watch; to all permissions and use key name.
Example:

-w /root -p w -k writing
-w /root -p r -k reading
...

But, RHEL 4.x can't this rule. For one directory watch, only one line rule accepting.
RHEL 4.x can't all permisions watch, and use key functionality.
Error: ( Error sending watch insert request (File exists) )

This subject true? And, how can i fix this issue?

Thank you, and sorry my serial posts.
Best Regards.

On Tue, Jul 20, 2010 at 4:00 PM, Steve Grubb <sgrubb@redhat.com> wrote:

On Tuesday, July 20, 2010 08:53:43 am List Quest wrote:
> For example watch /root directory and subdirectories:
>
> I can only -> Scan /root directory recursive(find root -type d); and add
> to audit.rules file all result lines.
>
> This technic true?

Yes, you can do that.

-Steve