I have a folder which I'd like to monitor with auditd, with the exception of one specific subdirectory. Is there any way I can disable monitoring just that subdirectory, but keep monitoring the rest of the dir recursively as usual?
Say, I first do: auditctl -w /var/mydata/ -k my-data -p w and want to exclude looking at /var/mydata/tmp_data/ Thanks! M G -- Linux-audit mailing list [email protected] https://www.redhat.com/mailman/listinfo/linux-audit
