Steve Grubb wrote: > On Tuesday 27 June 2006 17:15, Amy Griffis wrote: > >>If you would like to see a record in this case, you must add a watch >>for /var/log/audit. > > > I don't see a record watching this either.
I think we're missing the directory lookup syscall(s) on watches right now. -- ljk -- Linux-audit mailing list [email protected] https://www.redhat.com/mailman/listinfo/linux-audit
