I’d like to set a file system watch so that any activity in an auto-mounted directory is audited.  It looks like just setting a watch on a parent directory isn’t sufficient.  For example, if I have directory path  /dir1/dir2 and auto-mount something at /dir1/dir2/mount-dir, setting a file system watch on /dir1/dir2 doesn’t detect activity in the auto-mounted subtree.  Looking at the auditctl man page, it looks like I’d have to issue a command like “/sbin/auditctl –q /dir1/dir2/mount-dir,/dir1/dir2” to tell the kernel to watch the newly mounted file system as well.  Unfortunately, auto-mounts are, well, automatic, so there’s no one to issue that command.

Am I missing a better way to accomplish this goal?  Is my understanding wrong?  Any help would be appreciated.  Thanks,

--Tad Taylor