On 2021-06-21 12:52, warron.french wrote: These are two distinct rules, but redundant, so there won't be any conflict, but the second rule will never trigger. If you want finer grained triggering under one rule, likely with a different key, try instead something like: -w /etc/audit/rules.d/ -p a -k watch_audit_rules_d -w /etc/audit/ -p a -k watch_audit - RGB -- Richard Guy Briggs <rgb(a)redhat.com&gt; Sr. S/W Engineer, Kernel Security, Base Operating Systems Remote, Ottawa, Red Hat Canada IRC: rgb, SunRaycer Voice: +1.647.777.2635, Internal: (81) 32635