On Fri, 14 Aug 2020 20:06:34 +0200 peter enderborg <peter.enderborg@xxxxxxxx> wrote: > Im find with that, but then you can not do filtering? I would be > pretty neat with a filter saying tclass=file permission=write. > Well, if the mapping is stable, you could do: (tclass == 6) && (audited & 0x4) -- Steve
