Re: monitoring deletion of directories?
On Thursday, October 08, 2015 01:32:16 PM Bond Masuda wrote:
with linux audit, how do I monitor the deletion of directories? I am
already monitoring the unlink syscall, but it only seems to monitor
deleted files.
There is a rmdir syscall. Add that to your rule.
-Steve