Below is a patch to update the auditctl man page. The list of filters
had "watch" as a valid keyword, but as per my recent discussion with
Steve, the keyword is "path", not "watch".
This patch updates the man-page accordingly.
Thanks,
Mike
---
Signed-off-by: Michael Thompson <[EMAIL PROTECTED]>
--- audit-1.2.2-orig/docs/auditctl.8 2006-05-12 12:58:21.000000000 -0500
+++ audit-1.2.2/docs/auditctl.8 2006-05-17 14:59:32.000000000 -0500
@@ -131,6 +131,9 @@
.B msgtype
This is used to match the message type number. It should only be used
on the exclude filter list.
.TP
+.B path
+The full path of file to watch. This can only be used on the exit
filter list.
+.TP
.B pers
OS Personality Number
.TP
@@ -166,9 +169,6 @@
.TP
.B uid
User ID
-.TP
-.B watch
-Full Path of File to Watch
.RE
.TP
\fB\-w\fR <path>
--
Linux-audit mailing list
[email protected]
https://www.redhat.com/mailman/listinfo/linux-audit
