<html><head><style type='text/css'>p { margin: 0; }</style></head><body><div style='font-family: Times New Roman; font-size: 12pt; color: #000000'>Any idea the overhead involved? I have to do the auditing client-side on 12+ machines, because the NFS "server" isn't a standard box.<span><br><br>And of course, some of the clients that must be audited, are production or mission-critical.<br><br>And, I haven't read enough to say for sure, but it seems like auditd only wants to watch specific files, rather than all access in a whole file-system. Is that so?<br><br><span name="x"></span>David L. Willson<br>Trainer, Engineer, Enthusiast<br>RHCE MCT MCSE Network+ A+ Linux+ LPIC-1 NovellCLA UbuntuCP<br>tel://720.333.LANS<br>Freedom is better when you earn it. Learn Linux.<span name="x"></span><br></span><br><hr id="zwchr"><blockquote style="border-left: 2px solid rgb(16, 16, 255); margin-left: 5px; padding-left: 5px; color: rgb(0, 0, 0); font-weight: normal; font-style: normal; text-decoration: none; font-family: Helvetica,Arial,sans-serif; font-size: 12pt;">We use auditd to watch a system we export via CIFS. Files kept disappearing and we had to be able to track it. Turns out it was a user with a super sensitive mouse dragging folders to other folders. You just need to setup rules and you will be able to query for file accesses on that mount. <br>
<br>Dan Kulinski <br>
<br>_______________________________________________<br>clue mailing list: clue@cluedenver.org<br>For information, account preferences, or to unsubscribe see:<br>http://cluedenver.org/mailman/listinfo/clue</blockquote><br></div></body></html>