Changes made with chattr go unreported by auditd

by Cocowalla   Last Updated January 12, 2018 23:00 PM

I want to monitor a particular directory using auditd, so that any changes are logged. I've created a rule using:

auditctl -w /etc/my_path_to_monitor -p wa -k my_rule

This works great for everything I've tested so far, except changes made with chattr, such as:

chattr +S /etc/my_path_to_monitor/a_file

The use of chattr isn't resulting in any auditd log messages - how can I have such changes audited with auditd?

Tags : auditd


Related Questions



Audit ftp client connections

Updated November 28, 2015 13:00 PM


auditd auid changes after su

Updated July 09, 2015 13:00 PM

How do audit changes to dir via symlink?

Updated September 01, 2015 18:00 PM