Re: -w deprecation and -F dir= equivalence

On Wednesday, July 22, 2026 5:38:46 AM Eastern Daylight Time seth--- via Linux-audit wrote: Yes. There are a couple reasons, the main one being performance. But the other reason being exact control over what is being watched. That goes back to exact control I mentioned above. I'd suggest to try again with a newer version. There may have been a problem in an older release that checked first. But under the hood, they do almost the same thing but use the exact same kernel attributes to place the watch. How they differ is that '-w' enables all syscalls. Six or seven years ago, someone noticed this was hurting performance. They slimmed down the syscalls enabled and found the system was faster. '-w' has always enabled all syscalls, so I only changed the syscall based watch to be slimmed down. The second reason is '-w' changes behavior based on '/' being at the end. If the target is a directory and does not have '/', it watches the directory's inode. That might not be obvious. If the target includes '/', then it watches the directory recursively. Since this is non-obvious or at least easily missed, the -F path= and -F dir= make it very obvious that they will do something differently. Both should do the same thing. I tested it using the 4.2 prerelease code and both forms accept non-existing files. I'd do it ASAP so that it is obvious in the rules what you really want it to watch. I have not set a deadline. But people really should move so that when that day comes, they have no surprises. But if nothing else, for the performance gain. Maybe I'll drop it around the 4.3 time frame? -Steve