Auditing subdirectories with linux auditd

[kenny chia]

Hi
I have a RHEL4 and I am trying to use the auditd daemon to monitor changes to a directory and its sub directories

Unfortunately it seems that the auditctl command can only monitor a single directory but not its sub directory

I used the following command
# auditctl -w /home/mon/checkload -p war -k moncheckload

This only monitors /home/mon/checkload but not its sub directories.

How do I use auditctl to monitor activities in sub directories too?

[Ivan Ferreira]

In fact, auditd purpose is to monitor at file level, not directory level. Probably, for what you want, tripwire is your option (maybe snare).