I'm trying to figure out which processes are deleting files from a specific directory, so I want to set up and run
auditd on my system.
I've set up the following rule in
-w S unlink -S truncate -S ftruncate -a exit,always -k cache_deletion -w /home/myfolder/cache
Then I type this to start the audit daemon:
auditctl -R /etc/audit/audit.rules -e 1
But I get this error message:
Error - nested rule files not supported
Does anyone know what I am doing wrong here, and how I can resolve this?
Also, what do I have to do to get the daemon running at startup?