Hi,

I want to track file writes on a removable harddisk:

$ mount
...
/dev/sda9 on /mnt/volatile_folder type ext4 (rw)
...

$ cat /etc/audit/audit.rules
...
-w /mnt/volatile_folder -p w -k folder
...

External processes regularly unmount, format and mount /dev/sda9. Currently unmounting the device stops the auditd volatile_folder watcher and I have to restart auditd. Is there a better way?

Thx + Best

Fir