close 444118 thanks In Testing the command "auditctl -w /etc/shadow" correctly adds a watch for access to that file.
In Lenny there seemed to be some kernel issues with adding watches. This bug could have been a kernel issue. But in Squeeze it will all be working. So I'm closing this. -- To UNSUBSCRIBE, email to [email protected] with a subject of "unsubscribe". Trouble? Contact [email protected]
