topic Re: Tracking changes to system files... in Operating System - HP-UX

Tracking changes to system files...

Kevin Westover — Mon, 27 Oct 2003 12:47:58 GMT

Is anyone aware of a good software package that will monitor and track changes to system files, configuration scripts, kernel parameters, file system sizes, etc? Something that could show before and after information for any changes that are made to the system. Thanks.

Re: Tracking changes to system files...

Paddy_1 — Mon, 27 Oct 2003 12:51:57 GMT

See if any of the tools mentioned here will work for you.

http://www.stokely.com/unix.sysadm.resources/autosysmgm.backup.html

Re: Tracking changes to system files...

Steven E. Protter — Mon, 27 Oct 2003 12:53:53 GMT

Tripwire is the way to go here. Its designed specifically for this purpose. Its built into recent Red Hat distributions.

http://sourceforge.net/project/showfiles.php?group_id=3130

I don't know of anyone that built hp depots so this is something you want to obtain and compile.

SEP

Re: Tracking changes to system files...

Keith Buck — Mon, 27 Oct 2003 13:09:58 GMT

Depending on what you're trying to do, you might also consider HIDS

http://software.hp.com/portal/swdepot/displayProductInfo.do?productNumber=J5083AA

It will tell you when something changed and send you an alert.

On the other hand, if you're just trying to track authorized changes made by you or other admins, you might use a source control system, such as RCS or CVS.

The key is to know what threats you are concerned about. (mistakes and tracking down what changed vs. malicious break-ins)

-Keith

Re: Tracking changes to system files...

Garry Ferguson — Tue, 28 Oct 2003 10:03:30 GMT

Kevin,

I run a daily cron script to list any changes to system software. eg added s/w or patches. It doesn't do all you might require
but it could be used as a start.
I've attached the script. It runs on a RedHat
machine - ravel.

Garry

Re: Tracking changes to system files...

Geoff Wild — Tue, 28 Oct 2003 11:36:21 GMT

You can try:

http://www.cfengine.org/

What is Cfengine?
Cfengine, or the configuration engine is an autonomous agent and a middle to high level policy language for building expert systems which administrate and configure large computer networks. Cfengine uses the idea of classes and a primitive intelligence to define and automate the configuration and maintenance of system state, for small to huge configurations. Cfengine is designed to be a part of a computer immune system, and can be thought of as a gaming agent. It is ideal for cluster management and has been adopted for use all over the world in small and huge organizations alike.

Or, take a look at CCMON:

This is a valuable tool to monitor your environment to ensure all nodes are configured equally. You do NOT have to be using MC/ServiceGuard to use it.

http://h40045.www4.hp.com/data/ccmon-service-brief.pdf

Rgds...Geoff