Solaris 10 - How to audit only specific files
I've enable the audit of the class: lo,fw
It works well, I can access the result in /var/audit with the praudit command.
However I do not want to audit the file write events for all files on the file sytem.
I only want to audit: /etc/shadow and /etc/passwd. ..... Is there any way to do this.
I found a way to find out all events about /etc/shadow from teh /var/audit/* files..... but this not what i want.
I want that the audit only records events on some specific files or path ..... ?