On Wednesday 30 May 2007 14:11, Matthew Booth wrote: > Actually I would be matching on this in an external system. That system > would receive *all* open() calls. It just needs to be able to > differentiate nfs from non-nfs.
Ok, I thought you wanted to audit by file system type and have the kernel distinguish it. If its external/post-processing, Al gave you the answer. -Steve -- Linux-audit mailing list [email protected] https://www.redhat.com/mailman/listinfo/linux-audit
