Hi Richard. It looks like the -F exe= option is not supported at all regardless of negation.
Starting auditd: [ OK ] -F unknown field: exe ___ John Petrini
-- Linux-audit mailing list [email protected] https://www.redhat.com/mailman/listinfo/linux-audit
