Re: excluding auditd events
I do not know the answer to your question, but i suspect you will
stand
a better chance at finding a good answer on the linux-audit list.
You can subscribe here:
https://www.redhat.com/mailman/listinfo/linux-audit
Thanks for the pointer (google failed me on that one!). I just
subscribed, so will post there soon.
Note though that this list is moderated. So it may be a while before
your request for subscription is processed.
Noted, thanks again!