On Tuesday 30 January 2007 20:49, Walt Powell wrote: > What would the appropriate syscall be in the audit.rules file to log file > deletions with auditd?
Assuming current upstream kernel...In terms of watches, I think deletion is considered a write. But if you audit writes like this: auditctl -w /var/log/messages -p w -k delete-logs you will likely get more than you asked for. So, you could do it this way: auditctl -a exit,always -S unlink -F path=/var/log/messages -F key=delete-logs and then find them with: ausearch --start today -k delete-logs -Steve -- Linux-audit mailing list [email protected] https://www.redhat.com/mailman/listinfo/linux-audit
