1748021 Members
5215 Online
108757 Solutions
New Discussion юеВ

How to audit file access

 
Devesh Pant_1
Esteemed Contributor

How to audit file access

Hi Gurus,
is there a way to audit the system so that we have the ability to log if someone has accessed a file? if so, file, who? when? how log?


5 REPLIES 5
Arunvijai_4
Honored Contributor

Re: How to audit file access

Hi Devesh,

You can consider using Tripwire for this purpose, Check out this link for more information

http://sourceforge.net/projects/tripwire/

-Arun
"A ship in the harbor is safe, but that is not what ships are built for"
Devesh Pant_1
Esteemed Contributor

Re: How to audit file access

Thanks a lot Arun

I am looking for something native within the operating system like audsys etc. that can be used

Any ideas ?
Arunvijai_4
Honored Contributor

Re: How to audit file access

Hi Devesh,

You can turn on auditing on your system by,

/sbin/init.d/auditing start

Also, edit /etc/rc.confid.d/auditing to make any neccessary changes.

-Arun
"A ship in the harbor is safe, but that is not what ships are built for"
Devesh Pant_1
Esteemed Contributor

Re: How to audit file access

But will that give me what I am looking for ?
Arunvijai_4
Honored Contributor

Re: How to audit file access

Hi Devesh,

Maye be, you can try enabling audit and check. Take a look at this thread, it may shed some light

http://forums1.itrc.hp.com/service/forums/questionanswer.do?threadId=610228

-Arun
"A ship in the harbor is safe, but that is not what ships are built for"