title: Auditd - auditctl rule to monitor dir only (not all sub dir and files etc..)
body: <p>I am trying to use auditd to monitor changes to a directory.
  The problem is that when I setup a rule it does monitor the dir I specified but also all the sub dir and files making the monitor useless due to endless verbosity.</p>
  
  <p>Here is the rule I setup:</p>
  
  <pre><code>auditctl -w /home/raven/public_html -p war -k raven-pubhtmlwatch
  </code></pre>
  
  <p>when I search the logs using</p>
  
  <pre><code>ausearch -k raven-pubhtmlwatch
  </code></pre>
  
  <p>I get thousands of lines of logs that list everything under public_html/</p>
  
  <p>How can I limit the rule to changes on the directory specified only? </p>
  
  <p>Thank you very much.</p>