Re: Identifying writes to NFS
On Wednesday 30 May 2007 13:56, Alexander Viro wrote:
> I'd like to be able to reliably recognise a PATH record
which refers to
> an NFS mount.
>
> Any ideas? Thanks,
man statfs, look at f_type field there.
While that does tell you the file system type, the audit rule comparitor does
not use that field to trigger an event. Maybe that would be something useful
to add to the comparitor?
Matthew, what kernel are you using?
-Steve