On Wednesday 30 May 2007 14:11, Matthew Booth wrote:
Actually I would be matching on this in an external system. That
system
would receive *all* open() calls. It just needs to be able to
differentiate nfs from non-nfs.
Ok, I thought you wanted to audit by file system type and have the kernel
distinguish it. If its external/post-processing, Al gave you the answer.
-Steve