Re: File watching
> Instead, you audit the file open, and make a note of whether the
file
> was opened read-only, or for read/write. If it was opened for
> read/write, one presumes that it was written to.
Is it possible to tell if a file was opened read/write or read-only from
the events generated by audit?
Thanks,
Steve