Differences

This shows you the differences between two versions of the page.

--- tips:audit [2015/07/09 12:38] – created scipio
+++ tips:audit [2019/01/21 11:17] (current) – scipio
@@ Line 6: / Line 6: @@
 </code>
-Add watcher to /etc/audit/audit.rules to detect delete or write/append of /shares/pubblica/esca.doc
+Add watcher to **/etc/audit/audit.rules** to detect delete or write/append of /shares/pubblica/esca.doc
 <code>
 -w /shares/pubblica/esca.doc -p wa -k esca
@@ Line 15: / Line 15: @@
 Search events
 <code>
-ausearch -k esca
+ausearch -k esca | aureport -f -i
 </code>