https://bugzilla.suse.com/show_bug.cgi?id=1196048 Bug ID: 1196048 Summary: audit file watches do not really work? Classification: openSUSE Product: openSUSE Tumbleweed Version: Current Hardware: Other OS: Other Status: NEW Severity: Normal Priority: P5 - None Component: Kernel Assignee: kernel-bugs@opensuse.org Reporter: meissner@suse.com QA Contact: qa-bugs@suse.de Found By: --- Blocker: --- auditctl -e 1 auditctl -w /etc/issue if i do echo hallo >> /etc/issue -> not audited if i do vim /etc/issue ... remove hallo line and save ... -> audited cat /etc/issue -> not audited Not sure if I am doing it right. -- You are receiving this mail because: You are the assignee for the bug.