On Thursday, November 24, 2011 09:46:57 AM Marina Gray wrote: > I have a folder which I'd like to monitor with auditd, with the > exception of one specific subdirectory. Is there any way I can disable > monitoring just that subdirectory, but keep monitoring the rest of the > dir recursively as usual? > > Say, I first do: > > auditctl -w /var/mydata/ -k my-data -p w > > and want to exclude looking at /var/mydata/tmp_data/
The kernel was patched at some point to allow excluding folders, but the excluded folder has to be before the recursive folder - order matters. -a never,exit -F dir=/var/mydata/tmp_data/ -a always,exit -F dir=/var/mydata/ -F key=my-data -F perm=w If this doesn't work, you are probably on an older kernel that can't do it. -Steve -- Linux-audit mailing list [email protected] https://www.redhat.com/mailman/listinfo/linux-audit
