Re: How to exclude directories from auditing?
On Friday, October 25, 2013 06:28:23 AM Leam Hall wrote:
I know you can specify certain directories to watch. Is there a way
to
exclude sub-directories?
Pointers to docs are appreciated; I have a lot to learn!
Something like this should work:
-a never,exit -F dir=/var
Remember first match wins. Exclusions should come before other rules.
-Steve