Steve Grubb wrote: [Tue Jun 27 2006, 05:21:05PM EDT] > On Tuesday 27 June 2006 17:15, Amy Griffis wrote: > > If you would like to see a record in this case, you must add a watch > > for /var/log/audit. > > I don't see a record watching this either.
Hmmm, you're right. In this implementation, a directory lookup isn't considered an access of the object, but a directory listing is. -- Linux-audit mailing list [email protected] https://www.redhat.com/mailman/listinfo/linux-audit
