On Wednesday 17 May 2006 17:43, Michael C Thompson wrote: > # auditctl -a entry,always -S chmod -F "watch=/root/file" > -F unknown field: watch=/root/file
Ok, I misread what you were reporting...sorry. It is like this: auditctl -a exit,always -S chmod -F path=/root/file Must be exit list and use path not watch. -Steve -- Linux-audit mailing list [email protected] https://www.redhat.com/mailman/listinfo/linux-audit
