Home / server / Questions / 764135
In Process
Marcus Downing
Asked: 2016-03-17 06:52:00 +0800 CST

auditd: Difference between watch and syscall

  • 772

There appear to be two ways of specifying an auditd rule to watch a given file or folder. The first uses -a

-a exit,always -F dir=/path/to/file -F perm=wa -F success=1

And the second uses -w

-w /path/to/file -p wa

Aside from one being obviously shorter, the two appear to have the same effect. Is there some subtle difference between them I need to understand?

auditd

0 Answers