I have the following audit rule:

-a exit,always -F dir=/data -F arch=b64 -S open -S unlink -S unlinkat -S
link -S rename -S renameat S renameat2 -S chmod -S fchmod -S fchmodat -S
chown -S fchown -S fchownat -S mkdir -S rmdir -S setxattr -S lsetxattr -S
fsetxattr -S removexattr -S lremovexattr -S fremovexattr -k filesystem_op

I straced the "mv" command to be sure it's implemented using the renameat2
syscall:

# strace mv /data/test5.txt /data/test6.txt
execve("/bin/mv", ["mv", "/data/test5.txt", "/data/test6.txt"],
0x7ffdf760a210 /* 23 vars */) = 0
(...)
renameat2(AT_FDCWD, "/data/test5.txt", AT_FDCWD, "/data/test6.txt", 0) = 0
(...)

However, I don't see any events recorded in the auditd log file when I move
files using the "mv" command. Am I doing something wrong?


Thanks in advance.