Re: Monitoring events

>>> Is there's any kind of identifier that ties events to rules? >> Which kernel are you using? Are your events only watches or do you care >> about syscall auditing as well (meaning you have set some syscall audit >> rules) ? > kernel-2.6.16-1.2212.2.8_FC6.lspp.34.i686 on Fedora Core 5 > At the moment they are only watches, OK, the lspp series (so far) does not support the idea of a "key tag" as RHEL4 did.