Skip to contentSkip to conversation

monitoring deletion of directories?

DISCUSSION Bond Masuda 2 participants 2 messages Oct 8, 2015

lore
Share & tools
lore
#0 lore raw

with linux audit, how do I monitor the deletion of directories? I am already monitoring the unlink syscall, but it only seems to monitor deleted files.

thanks
Bond

#1 lore raw
Quoted 3 lines · Bond Masuda

with linux audit, how do I monitor the deletion of directories? I am already monitoring the unlink syscall, but it only seems to monitor deleted files.

There is a rmdir syscall. Add that to your rule.

-Steve