p2
06/05/2017, 3:04 PM"passwd": [
"/etc/passwd"
],
Gets me an attributes modified note and then every subsequent edit doesn't change anything in file_events. However when I do /etc/%passwd I get all the data I need but I also get all the .swp and swpx files.