Re: watches on rotated files, was (no subject)
On Thursday 24 May 2007 10:03, Kirkwood, David A. wrote:
How do I place a watch on files that are being rotated?
I suspect the files have to exist to place a watch on them. You can just touch
them to create them empty. ausearch/aureport probably doesn't care. We are
working on a directive to allow auditing a directory and its whole subtree
for RHEL5 and 2.6.23. Al should be posting the code for review rsn.
-Steve