triggers

[dhanish]

hI,
I have small requirement .I want to have some notifiaction not in term of mail eaxcatly whenever my etc/services and /etc/passwd ,group file is changed.I want this notification in a file.Which i can view on daily basis.Can anybody help me.

[Paula J Frazer-Campbell]

hi

--------cut here-----------
# Etc watcher
ls -l /etc/passwd >> /tmp/etclog
ls -l /etc/passwd >> /tmp/etclog

--------cut here----------

The above short script will do it just cron it to run as and when you require. Then just check the log file each day.


HTH

Paula

[dhanish]

Hi PAUL
Thanks for the reply.But can u explain it .I did not get your clue.

[Paula J Frazer-Campbell]

Hi

The ls -l /etc/passwd >> /tmp/etclog will do a long listing of the file passwd in /etc and using the >> will send this information to a file in /tmp called etclog (a new file)

The double >> will just add and entry above the last one:-

-r--r--r-- 1 root other 96421 Jun 18 14:34 /etc/passwd
-r--r--r-- 1 root other 96421 Jun 19 14:34 /etc/passwd

Paula

[Magdi KAMAL]

Hi Nitin,

you can do the following :

1. Create a script in /home/tmp with name generateOriginal.sh
it's content is :
/usr/bin/ls -l /etc/passwd > /home/tmp/originalTimeStamp.log

2.Create a script in /home/tmp with name generateActual.sh
it's content is :
/usr/bin/ls -l /etc/passwd > /home/tmp/actualTimeStamp.log

3. Create a script in /home/tmp with name compareTimeStamp.sh
it's content is :
/usr/bin/diff /home/tmp/originalTimeStamp.log /home/tmp/actualTimeStamp.log > /home/tmp/compareTimeStamp.log

4. execute crontab -e command and add the following ONE LINE:

00 17 * * * /home/tmp/compareTimeStamp.sh

5. You should change the mode of scripts in order to be able to execute them :

/usr/bin/chmod 700 generateOriginal.sh generateActual.sh compareTimeStamp.sh

And each day check the content of file /home/tmp/compareTimeStamp.log, if the /etc/passwd is still unchanged, th size of file /home/tmp/compareTimeStamp.log will be ZERO. If the size is different from ZERO so the content of /home/tmp/compareTimeStamp.log will show you what had changed in /etc/passwd.

You can do the same for any other file.
Bye

[dhanish]

Thanks Paul !!!!

[dhanish]

Thanks Kamal !!!!!