we have started auditing on our systems (file open, close, write etc.).
This is no problem on local and on statically mounted NFS systems (-a
exit,always -F dir=/a/b/c ...). However for automounted filesystems
auditd only reports on system calls on those filesystems which are
mounted when auditd starts.
Is there a way to make auditd aware of newly mounted NFS filesystems, so
that we can audit them, too?
Linux-audit mailing list