https://community.hpe.com/t5/operating-system-linux/auditing-subdirectories-with-linux-auditd/m-p/4332236#M34778 In fact, auditd purpose is to monitor at file level, not directory level. Probably, for what you want, tripwire is your option (maybe snare). Tue, 06 Jan 2009 13:46:48 GMT Ivan Ferreira 2009-01-06T13:46:48Z https://community.hpe.com/t5/operating-system-linux/auditing-subdirectories-with-linux-auditd/m-p/4332235#M34777 Hi<BR />I have a RHEL4 and I am trying to use the auditd daemon to monitor changes to a directory and its sub directories<BR /><BR />Unfortunately it seems that the auditctl command can only monitor a single directory but not its sub directory <BR /><BR />I used the following command<BR /># auditctl -w /home/mon/checkload -p war -k moncheckload<BR /><BR />This only monitors /home/mon/checkload but not its sub directories.<BR /><BR />How do I use auditctl to monitor activities in sub directories too? Tue, 06 Jan 2009 09:30:16 GMT https://community.hpe.com/t5/operating-system-linux/auditing-subdirectories-with-linux-auditd/m-p/4332235#M34777 kenny chia 2009-01-06T09:30:16Z https://community.hpe.com/t5/operating-system-linux/auditing-subdirectories-with-linux-auditd/m-p/4332236#M34778 In fact, auditd purpose is to monitor at file level, not directory level. Probably, for what you want, tripwire is your option (maybe snare). Tue, 06 Jan 2009 13:46:48 GMT https://community.hpe.com/t5/operating-system-linux/auditing-subdirectories-with-linux-auditd/m-p/4332236#M34778 Ivan Ferreira 2009-01-06T13:46:48Z