I would like to have some rules logged in a file that is not the default log file defined in /etc/audit/auditd.conf. Is there a way to have auditd log some rules in a separate file?Something like -w /tmp -LOGFILE /var/log/someother/location/log?
Is it possible to have auditd log different rules in different log files?
linux audit