Hello,
We need to log the operations that specific user on Solaris 10 (SPARC) is performing on one directory and it's contents. I was able to configure solaris auditing service (auditd) and it works fine. The only problem is that auditd logs huge amount of unneeded information. We need to log ONLY the access to specific directory and it's subdirectories and files. The operations that we need to log are:
read / write, rename, propchange and create / delete. I was not able to find any documentation on how to do that, so my questions are:
Is is possible ?
and
How to do that if possible ?
--
Thank you in advance for your help.