[Aide] Monitoring log files

[Richard van den Berg]

Sonixxfx wrote:
> Can you show me how I can do that? I have tried to set it up myself but
> without success. When something other than p+n+u+g of /etc/mtab changes,
> aide shows me that /etc is changed, but I don't want that.

That makes sense because some attributes of a directory are changed when
a file inside it is changed. This might do the trick:

=/etc p+n+u+g
=/etc/mtab p+n+u+g
/etc/.* p+i+n+u+g+s+b+m+c+md5+sha1

Play with the values for =/etc to get what you want.

Sincerely,

Richard van den Berg