I am currently using audit-1.6.5-9.el5. I have watch rules that look for modifications to directory content, example:
-w /etc -p aw
I would like to add an exception not to watch "/etc/mydir".
I know that audit 1.6 will watch /etc and all subdirs within that.
Is there a way I can add this exception?
Thanks
Ameel
-- Linux-audit mailing list [email protected] https://www.redhat.com/mailman/listinfo/linux-audit
