On Tue, 2005-06-21 at 18:14 -0500, Debora Velarde wrote: The default is that user messages are passed on. You need to insert a rule which causes them to be denied -- so if you want to cause them to be passed through only for one specific loginuid, you'd do something like this: auditctl -a user,never -F loginuid!=$LOGINUID auditctl -a user,always -F loginuid=$LOGINUID (I'm not sure if 'user' is the name that Steve actually chose when adding this functionality to auditctl, but I strongly suspect that'll be the case.) Please don't send HTML mail. -- dwmw2

David Woodhouse wrote: The way you mentioned is for User messages filtering on auid. I see in the man pages for auditctl there is a watch list as well. Can I safely assume that the method below should filter on loginuid for watches? auditctl -a watch,never -F auid=$LOGINUID auditctl -a watch,always -F auid=$LOGINUID Thanks - Loulwa

With audit 0.9.11 and kernel.audit.64 on a pSeries system, it just prints out the usage info (no other info about what it doesn't like) if I try running any of the following commands: auditctl -a user,never -F loginuid=500 auditctl -a user,never -F auid=500 auditctl -a user,always -F loginuid=500 auditctl -a user,always -F auid=500