Re: audit 1.2.2 released
On Wednesday 17 May 2006 17:43, Michael C Thompson wrote:
# auditctl -a entry,always -S chmod -F "watch=/root/file"
-F unknown field: watch=/root/file
Ok, I misread what you were reporting...sorry.
It is like this:
auditctl -a exit,always -S chmod -F path=/root/file
Must be exit list and use path not watch.
-Steve