* auditd for removable media/harddisks
@ 2020-11-30 14:46 foo
0 siblings, 0 replies; only message in thread
From: foo @ 2020-11-30 14:46 UTC (permalink / raw)
To: linux-audit
[-- Attachment #1.1: Type: text/plain, Size: 410 bytes --]
Hi,
I want to track file writes on a removable harddisk:
$ mount
...
/dev/sda9 on /mnt/volatile_folder type ext4 (rw)
...
$ cat /etc/audit/audit.rules
...
-w /mnt/volatile_folder -p w -k folder
...
External processes regularly unmount, format and mount /dev/sda9. Currently unmounting the device stops the auditd volatile_folder watcher and I have to restart auditd. Is there a better way?
Thx + Best
Fir
[-- Attachment #1.2: Type: text/html, Size: 1083 bytes --]
[-- Attachment #2: Type: text/plain, Size: 102 bytes --]
--
Linux-audit mailing list
Linux-audit@redhat.com
https://www.redhat.com/mailman/listinfo/linux-audit
^ permalink raw reply [flat|nested] only message in thread
only message in thread, other threads:[~2020-11-30 14:57 UTC | newest]
Thread overview: (only message) (download: mbox.gz / follow: Atom feed)
-- links below jump to the message on this page --
2020-11-30 14:46 auditd for removable media/harddisks foo
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.