How to enable audit for file on nfs server?

  • Add -w /NFS-MOUNT/ -p wa -k NFS-MOUNT line at the end of file /etc/audit/audit.rules

[root@COMPUTE ~]# cat /etc/audit/audit.rules
## This file is automatically generated from /etc/audit/rules.d
-b 8192
-f 1
-w /NFS-MOUNT/ -p wa -k NFS-MOUNT

  • Execute the following command to restart auditd service

service auditd restart

Leave a Reply

Your email address will not be published. Required fields are marked *