How to exclude directories from auditing?
I know you can specify certain directories to watch. Is there a way to exclude sub-directories?
Pointers to docs are appreciated; I have a lot to learn!
Thanks!
Leam
Signature · 2 lines
http://31challenge.net http://31challenge.net/insight
Quoted 4 lines · Leam Hall
I know you can specify certain directories to watch. Is there a way to exclude sub-directories?
Pointers to docs are appreciated; I have a lot to learn!
Something like this should work:
-a never,exit -F dir=/var
Remember first match wins. Exclusions should come before other rules.
-Steve