monitoring deletion of directories?
with linux audit, how do I monitor the deletion of directories? I am already monitoring the unlink syscall, but it only seems to monitor deleted files.
thanks
Bond
Quoted 3 lines · Bond Masuda
with linux audit, how do I monitor the deletion of directories? I am already monitoring the unlink syscall, but it only seems to monitor deleted files.
There is a rmdir syscall. Add that to your rule.
-Steve