Re: Logging failed open() calls on /var/log/audit/audit.log
Steve Grubb wrote: [Tue Jun 27 2006, 05:21:05PM EDT]
On Tuesday 27 June 2006 17:15, Amy Griffis wrote:
> If you would like to see a record in this case, you must add a watch
> for /var/log/audit.
I don't see a record watching this either.
Hmmm, you're right.
In this implementation, a directory lookup isn't considered an access
of the object, but a directory listing is.