---------- Forwarded message ----------
From: 4javier <4javiereg4@gmail.com>
Date: 2011/6/2
Subject: Re: Possible regression
To: Steve Grubb <sgrubb@redhat.com>


root@Archbox /home/javier $ touch /tmp/test
root@Archbox /home/javier $ cat /tmp/test
root@Archbox /home/javier $ auditctl -w /tmp/test -p wa
root@Archbox /home/javier $ echo ppp >> /tmp/test
root@Archbox /home/javier $ cat /tmp/test
ppp
root@Archbox /home/javier $ ausearch -i -f /tmp/test
<no matches>
root@Archbox /home/javier $ auditctl -l
LIST_RULES: exit,always watch=/tmp/test perm=wa
root@Archbox /home/javier $ echo ppp > /tmp/test
root@Archbox /home/javier $ ausearch -i -f /tmp/test
<no matches>
root@Archbox /home/javier $ ausearch -f /tmp/test
<no matches>

As you can see from auditcrl -l output, rule seems to be correctly set, but ausearch doesn't show anything.