Re: two sets of fs_watch/fs_inode messages?
>I'm running the sample CAPP rules with the .87 kernel and
1.0.1
>audit tools. I'm seeing duplicate watch/inode messages sometimes.
Did this happen in previous kernels? .85 or .80 for example.
I just tried .77 and .81 (what I had handy on my system) and it does the
same on both of those.
-- ljk