Take the 2-minute tour ×
Super User is a question and answer site for computer enthusiasts and power users. It's 100% free, no registration required.

I am trying to use auditd to monitor changes to a directory. The problem is that when I setup a rule, it monitors the directory I specified, but also all the subdirectories and files underneath it, making the monitoring useless due to endless verbosity.

Here is how I setup the rule:

auditctl -w /home/raven/public_html -p war -k raven-pubhtmlwatch

When I search the logs using

ausearch -k raven-pubhtmlwatch

I get thousands of lines from the logs that list everything under public_html.

How can I limit the rule to changes on the directory specified only?

share|improve this question
also asked here: stackoverflow.com/q/19031898/7552 –  glenn jackman Sep 26 '13 at 16:30

1 Answer 1

up vote 3 down vote accepted

Credit goes to Steve @ redhat who answered my question on the linux-audit mailing list:

A watch is really a syscall rule in disguise. If you place a watch on a directory, auditctl will turn it into:

-a exit,always -F dir=/home/raven/public_html -F perm=war -F key=raven-pubhtmlwatch

The -F dir field is recursive. However, if you just want to watch the directory entries, you can change that to -F path.

-a exit,always -F path=/home/raven/public_html -F perm=war -F key=raven-pubhtmlwatch

This is not recursive and just watches the inode that the directory occupies.

I had to add the rule manually in /etc/audit/audit.rules then restart auditd with

/etc/init.d/auditd restart

now the rules are added and it works great!

share|improve this answer

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.