I'm working with the audit system on aix 5.1 and 5.3 . But after lots of googling and RTFM, I can't figure out how to audit all files in a given directory rather than specifying each file individually like /etc. And how can I exclude a directory such as /var/tmp so I don't get records for every temp file vi creates, etc. I would like to disable auditing certain events on certain objects but find that the config files don't provide that or at least it is not well documented. My boxes are only accessed by admin users so I want to know virtually everything they do but the noise is deafening

Thanks