通过 man 手册，我知道了一些关于auditctl. 但是通过选项-w path，我发现了一些信息如下：
在路径中插入文件系统对象的监视。您不能将监视插入顶级目录。这是内核禁止的。通配符也不支持，会产生警告。
根据我的理解，我认为该命令auditctl -w / 无法将手表插入顶级目录。但是我在 CentOS 中的测试，发现没问题？
结果测试信息：
[centos@localhost ~]$ sudo auditctl -w /
[centos@localhost ~]$ sudo auditctl -l
-w / -p rwxa
[centos@localhost ~]$ cd /
[centos@localhost /]$ pwd
/
[centos@localhost /]$ ll
total 24
-rw-r--r--. 1 root root 0 Mar 13 17:01 1
lrwxrwxrwx. 1 root root 7 Mar 13 16:56 bin -> usr/bin
dr-xr-xr-x. 4 root root 4096 Mar 13 17:15 boot
drwxr-xr-x. 20 root root 3320 Mar 14 02:15 dev
drwxr-xr-x. 142 root root 8192 Mar 14 02:14 etc
drwxr-xr-x. 3 root root 20 Mar 13 17:12 home
lrwxrwxrwx. 1 root root 7 Mar 13 16:56 lib -> usr/lib
lrwxrwxrwx. 1 root root 9 Mar 13 16:56 lib64 -> usr/lib64
drwxr-xr-x. 2 root root 6 Nov 5 11:38 media
-rw-r--r--. 1 root root 0 Mar 13 21:40 mmm
drwxr-xr-x. 2 root root 6 Nov 5 11:38 mnt
drwxr-xr-x. 3 root root 16 Mar 13 17:08 opt
dr-xr-xr-x. 219 root root 0 Mar 14 02:14 proc
dr-xr-x---. 6 root root 234 Mar 13 11:53 root
drwxr-xr-x. 40 root root 1180 Mar 14 02:15 run
lrwxrwxrwx. 1 root root 8 Mar 13 16:56 sbin -> usr/sbin
drwxr-xr-x. 2 root root 6 Nov 5 11:38 srv
dr-xr-xr-x. 13 root root 0 Mar 14 02:14 sys
drwxrwxrwt. 42 root root 4096 Mar 14 04:04 tmp
drwxr-xr-x. 2 root root 6 Mar 13 21:40 ttt
drwxr-xr-x. 13 root root 155 Mar 13 16:56 usr
drwxr-xr-x. 21 root root 4096 Mar 14 02:14 var
[centos@localhost /]$ sudo mkdir alex
[centos@localhost /]$ sudo touch alexzl
[centos@localhost /]$ ll
total 24
-rw-r--r--. 1 root root 0 Mar 13 17:01 1
drwxr-xr-x. 2 root root 6 Mar 14 04:17 alex
-rw-r--r--. 1 root root 0 Mar 14 04:17 alexzl
lrwxrwxrwx. 1 root root 7 Mar 13 16:56 bin -> usr/bin
dr-xr-xr-x. 4 root root 4096 Mar 13 17:15 boot
drwxr-xr-x. 20 root root 3320 Mar 14 02:15 dev
drwxr-xr-x. 142 root root 8192 Mar 14 02:14 etc
drwxr-xr-x. 3 root root 20 Mar 13 17:12 home
lrwxrwxrwx. 1 root root 7 Mar 13 16:56 lib -> usr/lib
lrwxrwxrwx. 1 root root 9 Mar 13 16:56 lib64 -> usr/lib64
drwxr-xr-x. 2 root root 6 Nov 5 11:38 media
-rw-r--r--. 1 root root 0 Mar 13 21:40 mmm
drwxr-xr-x. 2 root root 6 Nov 5 11:38 mnt
drwxr-xr-x. 3 root root 16 Mar 13 17:08 opt
dr-xr-xr-x. 218 root root 0 Mar 14 02:14 proc
dr-xr-x---. 6 root root 234 Mar 13 11:53 root
drwxr-xr-x. 40 root root 1180 Mar 14 02:15 run
lrwxrwxrwx. 1 root root 8 Mar 13 16:56 sbin -> usr/sbin
drwxr-xr-x. 2 root root 6 Nov 5 11:38 srv
dr-xr-xr-x. 13 root root 0 Mar 14 02:14 sys
drwxrwxrwt. 42 root root 4096 Mar 14 04:04 tmp
drwxr-xr-x. 2 root root 6 Mar 13 21:40 ttt
drwxr-xr-x. 13 root root 155 Mar 13 16:56 usr
drwxr-xr-x. 21 root root 4096 Mar 14 02:14 var
[centos@localhost /]$ sudo ausearch -f /
.............
.............
time->Tue Mar 14 04:17:00 2017
type=PATH msg=audit(1489479420.957:1682): item=1 name="alex" objtype=CREATE
type=PATH msg=audit(1489479420.957:1682): item=0 name="/" inode=64 dev=fd:00 mode=040555 ouid=0 ogid=0 rdev=00:00 obj=system_u:object_r:root_t:s0 objtype=PARENT
type=CWD msg=audit(1489479420.957:1682): cwd="/"
type=SYSCALL msg=audit(1489479420.957:1682): arch=c000003e syscall=83 success=no exit=-13 a0=7ffeb030b435 a1=1ff a2=1ff a3=7ffeb030a370 items=2 ppid=3444 pid=5955 auid=1000 uid=1000 gid=1000 euid=1000 suid=1000 fsuid=1000 egid=1000 sgid=1000 fsgid=1000 tty=pts0 ses=1 comm="mkdir" exe="/usr/bin/mkdir" subj=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 key=(null)
.............
time->Tue Mar 14 04:17:39 2017
type=PATH msg=audit(1489479459.343:1915): item=1 name="/lib64/ld-linux-x86-64.so.2" inode=33613563 dev=fd:00 mode=0100755 ouid=0 ogid=0 rdev=00:00 obj=system_u:object_r:ld_so_t:s0 objtype=NORMAL
type=PATH msg=audit(1489479459.343:1915): item=0 name="/usr/bin/sudo" inode=1461019 dev=fd:00 mode=0104111 ouid=0 ogid=0 rdev=00:00 obj=system_u:object_r:sudo_exec_t:s0 objtype=NORMAL
type=CWD msg=audit(1489479459.343:1915): cwd="/"
type=EXECVE msg=audit(1489479459.343:1915): argc=3 a0="sudo" a1="touch" a2="alexzl"
type=BPRM_FCAPS msg=audit(1489479459.343:1915): fver=0 fp=0000000000000000 fi=0000000000000000 fe=0 old_pp=0000000000000000 old_pi=0000000000000000 old_pe=0000000000000000 new_pp=0000001fffffffff new_pi=0000000000000000 new_pe=0000001fffffffff
type=SYSCALL msg=audit(1489479459.343:1915): arch=c000003e syscall=59 success=yes exit=0 a0=e21e00 a1=e99fb0 a2=e34670 a3=7ffe09a62fa0 items=2 ppid=3444 pid=5971 auid=1000 uid=1000 gid=1000 euid=0 suid=0 fsuid=0 egid=1000 sgid=1000 fsgid=1000 tty=pts0 ses=1 comm="sudo" exe="/usr/bin/sudo" subj=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 key=(null)
----
为什么man手册不支持向顶层目录插入watch，但测试可以？