is this message necessary?
As some of us have been experimenting with adding/removing lots of
file system watches, I've noticed that we get one of these messages
in the audit log each time a file system watch is removed, including
during an 'auditctl -D'.
type=CONFIG_CHANGE msg=audit(1131576749.186:1182016): auid=4294967295
removed watch
I'm wondering about the usefulness of this message since it doesn't
identify the watch that's being removed. If we need this message,
shouldn't it identify the watch that's being removed? If we don't need
this message, can we delete it?
-- ljk