"file alteration monitor"

[Jim Galliher]

Does anyone know if HP has an equivalent of file alteration monitor (fam) or if there is a supported version of fam for hpux?


Thanks,

[Ivan Krastev]

Hi Jim,

for file monitor you can use tripwire - part of internet express.

http://h20338.www2.hp.com/hpux11i/cache/324414-0-0-225-121.html?jumpid=reg_R1002_USEN

cheers,
ivan

[Wim Rombauts]

HP has HIDS : Host Intrusion Detection System.
As far as I know, this software is free with HP-UX. It comes with a configuration to monitor critical system files, but it can easily be modified to monitor any file and mail an alert if a file is :
- modified
- modified by another user than the file owner
- modified while it is an append-only file (logfiles)

[Jim Galliher]

Do these tools have the ability to report/notify if a file is added to a directory?

[Bill Hassell]

Yes, but it is important to understand just how large the effort might be. Both Tripwire and HIDS require a *lot* of configuration. Otherwise, you might be getting 100 emails per second for a busy system. Usually, this type of question comes with limited scope. For instance, ordinary users can never create or remove files in a properly protected directory.

[Jannik]

you could use cfengine and the build in md5 checksum facility.
You would have to configure some conf files but is do-able www.cfengine.org. The software is to be found at:
http://hpux.cs.utah.edu/hppd/hpux/Sysadmin/cfengine-2.1.21/