
filter 0
  name = ssh
  collect = read AND write
end

filter 1
  name = rsh
  collect = read AND write
  offspring = yes ; rsh forks another process
end 

filter 2
  name = telnet
  collect = read AND write
end

filter 3
  name = rlogin
  collect = read AND write
  offspring = yes ; rlogin forks another process
end 

filter 4
  name = passwd
  collect = read
end

filter 5
  name = login
  collect = read
end

;filter 6
;  name = csh
;  ruid = 56264 
;  collect = read AND write
;  offspring = yes
;end

;filter 7
;  name = su
;  collect = read
;end

; specify any other rules, up to index 15, as above


