This is caused by denied_mask="receive" in the log line and can possibly affect all profiles. (To explain the "reweive" - "c" (create) file log events get mapped to "w" (write) ;-)
The problem is that operation="file_perm" indicates a file event, but the log event obviously is a network event.
I'll probably need to implement a way to check file vs. network event that is not based on the operation= part.
This is caused by denied_ mask="receive" in the log line and can possibly affect all profiles. (To explain the "reweive" - "c" (create) file log events get mapped to "w" (write) ;-)
The problem is that operation= "file_perm" indicates a file event, but the log event obviously is a network event.
I'll probably need to implement a way to check file vs. network event that is not based on the operation= part.
BTW: No need for more debug logs ;-)