@@ -104,14 +104,9 @@ def test_rmdir_empty(monitored_dir, server, fact_config, dirname):
104104 f"Expected exactly 1 inode removed for file deletion, got { file_delta } "
105105
106106 # Now remove the empty directory with rmdir
107+ # Note: Directory deletions are tracked internally but not sent as events to sensors
107108 os .rmdir (test_dir )
108109
109- # Directory deletion should be reported (TODO: this will be filtered out later)
110- e3 = Event (process = process , event_type = EventType .UNLINK ,
111- file = test_dir , host_path = test_dir )
112-
113- server .wait_events ([e3 ])
114-
115110 # Check that directory deletion incremented both metrics by exactly 1
116111 final_inode_removed = get_inode_removed_count (fact_config )
117112 final_kernel_rmdir = get_kernel_rmdir_processed (fact_config )
@@ -191,22 +186,16 @@ def test_rmdir_recursive_with_rm(monitored_dir, server, fact_config):
191186 if proc .returncode != 0 :
192187 raise RuntimeError (f"rm command failed with exit code { proc .returncode } " )
193188
194- # All deletions should be tracked: 3 files + 3 directories
195- # rm -rf deletes each directory immediately after it empties (interleaved):
196- # file3, level3 (now empty) , file2, level2 (now empty), file1, level1 (now empty)
189+ # Only file deletions are reported as events
190+ # Directory deletions are tracked internally but not sent to sensors
191+ # rm -rf deletes depth-first: file3 , file2, file1
197192 unlink_events = [
198193 Event (process = rm_process , event_type = EventType .UNLINK ,
199194 file = file3 , host_path = file3 ),
200- Event (process = rm_process , event_type = EventType .UNLINK ,
201- file = level3 , host_path = level3 ),
202195 Event (process = rm_process , event_type = EventType .UNLINK ,
203196 file = file2 , host_path = file2 ),
204- Event (process = rm_process , event_type = EventType .UNLINK ,
205- file = level2 , host_path = level2 ),
206197 Event (process = rm_process , event_type = EventType .UNLINK ,
207198 file = file1 , host_path = file1 ),
208- Event (process = rm_process , event_type = EventType .UNLINK ,
209- file = level1 , host_path = level1 ),
210199 ]
211200
212201 server .wait_events (unlink_events )
@@ -278,12 +267,11 @@ def test_rmdir_ignored(monitored_dir, ignored_dir, server, fact_config):
278267 os .remove (monitored_file )
279268 os .rmdir (monitored_subdir )
280269
281- # Both deletions should be tracked
270+ # Only file deletion is reported as an event
271+ # Directory deletions are tracked internally but not sent to sensors
282272 deletion_events = [
283273 Event (process = process , event_type = EventType .UNLINK ,
284274 file = monitored_file , host_path = monitored_file ),
285- Event (process = process , event_type = EventType .UNLINK ,
286- file = monitored_subdir , host_path = monitored_subdir ),
287275 ]
288276
289277 server .wait_events (deletion_events )
@@ -346,12 +334,11 @@ def test_rmdir_with_parent_inode(monitored_dir, server, fact_config):
346334 os .remove (test_file )
347335 os .rmdir (subdir )
348336
349- # Verify deletions are tracked
337+ # Verify file deletion is tracked
338+ # Directory deletions are tracked internally but not sent to sensors
350339 deletion_events = [
351340 Event (process = process , event_type = EventType .UNLINK ,
352341 file = test_file , host_path = test_file ),
353- Event (process = process , event_type = EventType .UNLINK ,
354- file = subdir , host_path = subdir ),
355342 ]
356343 server .wait_events (deletion_events )
357344
0 commit comments