Home / server / Questions / 1047412
In Process
RedTedRedemption
Asked: 2020-12-24 23:31:28 +0800 CST

selinux audit rule not logging anything

  • 772

I am trying to audit a directory tree for read, write, and permissions change. I created the rule using auditctl -w <path> -k media-watch, but ausearch -k media-watch only shows the creation (or deletion for debugging) of the rule, and not file creation or changes within the specified directory or below it in the tree. Selinux is disabled, if that's relevant.

Why? How can I make sure file access/changes are logged for auditing?

selinux auditd

1 Answers

  1. The man page says that -w is deprecated, so I wouldn't be using it. I'd be using the current format for such a rule instead. For example:

    auditctl -a always,exit -F dir=/path/to/dir/ -k media-watch
    • 1