On Fri, 14 Aug 2020 20:06:34 +0200 peter enderborg <peter.enderb...@sony.com> wrote:
> Im find with that, but then you can not do filtering? I would be
> pretty neat with a filter saying tclass=file permission=write.
>
Well, if the mapping is stable, you could do:
(tclass == 6) && (audited & 0x4)
-- Steve
