Checkin when a file has been moved.

[Henry Chua]

Hi there,

Just want to find out, is there anyway I can find out when a file has been moved in my system. And how can I control the file moving in my system. THank u!!

regards..

[Sridhar Bhaskarla · Accepted solution]

Hi Henry,

Not quite sure if I understood your question. You check for the existence of a file (moved or deleted or renamed) using 'if'.

if [[ -a /somewhere/file ]]
then
echo "File is there"

else
echo "File is not there"

fi

-Sri

[Henry Chua]

Hi Sri,

Actually I am my problem is, some files on my system were moved recently, and I am interested in finding out when these files have been moved. Is there anyway I can do this? THank u!

Cheers
Henry

[Sridhar Bhaskarla]

Well.. you will need to enable "Auditing" or install HIDS software on the system. "Auditing" is very easy to configure. It has got less than 5 commands. 'audsys' 'audmon' 'audsys' 'audusr' and 'audisp'. man auditing for more information.

Depending on your configuration, AUditing can generate a lot of data. So, you have to choose the events and system calls (audevent) carefully to monitor. You will need to enable atleast delete,moddac and modaccess events to capture the file modification information. 'audisp' can help you to read the binary data into human readable form. You will need to convert your system to trusted.

On the other hand, if you know the file, then you can probably write a script that runs every x minutes to check the file. It's a very primitive way and you only get the coordinates of the time when the file was (re)moved.

-Sri

[Brian Barrett_1]

For Sridhar Bhaskarla ONLY:

Sri, I apologize in advance for the awkward communique. I was unable to find your email. Also, I apologize for any false presumption of any relation to Alex Bhaskarla. Alex owes me $34 for a December Ebay transaction. And I am attempting to collect independently. Please contact me for further information.

Regards,
Brian Barrett
libran3@excite.com
541-490-5376

PS This message content in no way reflects the integrity of Sri. By all accounts on this message board, Sri is a generous, honest, and helpful individual.

[Mic V.]

Basically, no, assuming as written above that it's a vanilla (normal HP-UX) system.

But there are some things you can do might give you some ideas.

The most fruitful idea is to make use of your backup software. If files are there one day and not the next, you have some idea when they were moved. The down sides are you have to know what the files are (or else be able to "diff" two lists of files given to you by the backup software), it's time-consuming, and not very accurate.

Another, not usually very useful--you can look at the date on the parent directory. If the directory doesn't change much, it can at least give you an idea as to when something was moved.

Looking at the permissions on a directory can help you figure out who may have made a change.

As far as controlling who can move files, standard UNIX permissions (chown, chgrp, chmod) are the usual way. There are also extended ACLs available on, I believe, only HFS filesystems (this type of filesystem is no longer widely used). Another way to control who can move files is to write a "wrapper" program that takes a request, decides if the request is ok, and moves a file (on the user's behalf) only if the request is ok. I'm sure there are other things, but this is what comes to mind.

HTH.