Steve wrote: [Wed Jun 14 2006, 01:46:59PM EDT] > >I expected to see unlink... > > > >Any ideas? > > This may be a result of the discussion posted previously: > > [PATCH git] fix missing records when watched files removed > > If so, please ignore this.
Yes. If you don't have that patch, you won't see the unlink event. -- Linux-audit mailing list [email protected] https://www.redhat.com/mailman/listinfo/linux-audit
