Hello there,
I'm looking for a way, to get only logs when a file was open for write.
At the moment, full_audit:success = open produces:
|open|ok|r| too. But I do need the |open|ok|w| only.
Is there a way to get the entries with |w| only ?
Thanks, Frank