* auditd for removable media/harddisks
@ 2020-11-30 14:46 foo
0 siblings, 0 replies; only message in thread
From: foo @ 2020-11-30 14:46 UTC (permalink / raw
To: linux-audit@redhat.com
[-- Attachment #1.1: Type: text/plain, Size: 410 bytes --]
Hi,
I want to track file writes on a removable harddisk:
$ mount
...
/dev/sda9 on /mnt/volatile_folder type ext4 (rw)
...
$ cat /etc/audit/audit.rules
...
-w /mnt/volatile_folder -p w -k folder
...
External processes regularly unmount, format and mount /dev/sda9. Currently unmounting the device stops the auditd volatile_folder watcher and I have to restart auditd. Is there a better way?
Thx + Best
Fir
[-- Attachment #1.2: Type: text/html, Size: 1083 bytes --]
[-- Attachment #2: Type: text/plain, Size: 102 bytes --]
--
Linux-audit mailing list
Linux-audit@redhat.com
https://www.redhat.com/mailman/listinfo/linux-audit
^ permalink raw reply [flat|nested] only message in thread
only message in thread, other threads:[~2020-11-30 14:57 UTC | newest]
Thread overview: (only message) (download: mbox.gz follow: Atom feed
-- links below jump to the message on this page --
2020-11-30 14:46 auditd for removable media/harddisks foo
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for read-only IMAP folder(s) and NNTP newsgroup(s).