Fwd: Possible regression

---------- Forwarded message ---------- From: 4javier <4javiereg4(a)gmail.com&gt; Date: 2011/6/2 Subject: Re: Possible regression To: Steve Grubb <sgrubb(a)redhat.com&gt; root@Archbox /home/javier $ touch /tmp/test root@Archbox /home/javier $ cat /tmp/test root@Archbox /home/javier $ auditctl -w /tmp/test -p wa root@Archbox /home/javier $ echo ppp >> /tmp/test root@Archbox /home/javier $ cat /tmp/test ppp root@Archbox /home/javier $ ausearch -i -f /tmp/test <no matches> root@Archbox /home/javier $ auditctl -l LIST_RULES: exit,always watch=/tmp/test perm=wa root@Archbox /home/javier $ echo ppp > /tmp/test root@Archbox /home/javier $ ausearch -i -f /tmp/test <no matches> root@Archbox /home/javier $ ausearch -f /tmp/test <no matches> As you can see from auditcrl -l output, rule seems to be correctly set, but ausearch doesn't show anything. 2011/6/2 Steve Grubb <sgrubb(a)redhat.com&gt;