f /tmp/arch-audit.log 0644 nobody nobody -