I mean just the file "creation" which is the "first write" of a file. Here is my full_audit config: full_audit:prefix = %u|%m|%I|%S full_audit:success = mkdir rmdir link unlink rename full_audit:failure = none full_audit:facility = local7 full_audit:priority = notice mkdir and rmdir work...