Secure OS Software for Linux
cancel
Showing results for 
Search instead for 
Did you mean: 

file system level audit in RedHat Linux (RHEL 4 & 5)

Gaby1110
Frequent Advisor

file system level audit in RedHat Linux (RHEL 4 & 5)

Hi,

Can we enable audit @ Linux level, to capture any kind of changes to files in a set of directories (recursively ), Would the audit be able to tell us in a systematic way if the files are getting changed.?

I need this help on RedHat Linux (RHEL 4 & 5)running 2.6 kernel.

Thanks in advance
Gabu
4 REPLIES
Steven E. Protter
Exalted Contributor

Re: file system level audit in RedHat Linux (RHEL 4 & 5)

Shalom Gabu,

You can run a simple script to find new or modified files.

find /filesystem +mtime 1 -exec ls -l

Something along that lines will provide a list of all files modified in the past day, or use +ctime to get file creates the past day.

This is something most shops with out complicated revision control systems script in house.

SEP
Steven E Protter
Owner of ISN Corporation
http://isnamerica.com
http://hpuxconsulting.com
Sponsor: http://hpux.ws
Twitter: http://twitter.com/hpuxlinux
Founder http://newdatacloud.com
Gaby1110
Frequent Advisor

Re: file system level audit in RedHat Linux (RHEL 4 & 5)

Hi Steven,

Thanks for the reply.

When I run 'find /filesystem +mtime 1 -exec ls -l' It says
"find: missing argument to `-exec'"

Please help.

Thanks
Gaby

Ivan Ferreira
Honored Contributor

Re: file system level audit in RedHat Linux (RHEL 4 & 5)

Yes you can. Just consider that enabling audit on files will cause a performance degradation. You should audit only what you really need to audit.

Check this link:

http://forums13.itrc.hp.com/service/forums/questionanswer.do?admit=109447627+1253890219156+28353475&threadId=1041575
Por que hacerlo dificil si es posible hacerlo facil? - Why do it the hard way, when you can do it the easy way?
Don Mallory
Trusted Contributor

Re: file system level audit in RedHat Linux (RHEL 4 & 5)

If you are looking for an immediate response, yes, auditd and possibly acct (process level accounting).

If you are just looking for a daily / weekly report, check out AIDE. It's installed by default. Will require initialisation, and you will be need to tweak the config for things you expect to change, but it will definitively tell you what has changed on the host.