Hi,

is there a way to audit ipset changes?

The closest I got was to log the specific "socket(AF_NETLINK, SOCK_RAW, NETLINK_NETFILTER)" call that ipset makes, but that obviously also triggers read-only operations like "ipset list", and any other app that opens suck a socket.