close 444118 thanks In Testing the command "auditctl -w /etc/shadow" correctly adds a watch for access to that file.
In Lenny there seemed to be some kernel issues with adding watches. This bug could have been a kernel issue. But in Squeeze it will all be working. So I'm closing this. -- To UNSUBSCRIBE, email to debian-bugs-dist-requ...@lists.debian.org with a subject of "unsubscribe". Trouble? Contact listmas...@lists.debian.org