On Tuesday 30 January 2007 20:49, Walt Powell wrote: Assuming current upstream kernel...In terms of watches, I think deletion is considered a write. But if you audit writes like this: auditctl -w /var/log/messages -p w -k delete-logs you will likely get more than you asked for. So, you could do it this way: auditctl -a exit,always -S unlink -F path=/var/log/messages -F key=delete-logs and then find them with: ausearch --start today -k delete-logs -Steve