Re: file watch and stat
Amy Griffis wrote:
Michael C Thompson wrote: [Mon Oct 02 2006, 03:16:19PM EDT]
> Hey all,
>
> I'm trying to figure out why having a watch a on file is not generating
> a record when I stat said file.
>
> Put a watch on a file, and do stat file.
>
> No record... I'm not sure why this is happening, isn't getting such
> information considered security relevant?
What is your audit rule?
auditctl -w /path/to/file
Mike