file system level audit in RedHat Linux (RHEL 4 & 5)

[Gaby1110]

Hi,

Can we enable audit @ Linux level, to capture any kind of changes to files in a set of directories (recursively ), Would the audit be able to tell us in a systematic way if the files are getting changed.?

I need this help on RedHat Linux (RHEL 4 & 5)running 2.6 kernel.

Thanks in advance
Gabu

[Steven E. Protter]

Shalom Gabu,

You can run a simple script to find new or modified files.

find /filesystem +mtime 1 -exec ls -l

Something along that lines will provide a list of all files modified in the past day, or use +ctime to get file creates the past day.

This is something most shops with out complicated revision control systems script in house.

SEP

[Gaby1110]

Hi Steven,

Thanks for the reply.

When I run 'find /filesystem +mtime 1 -exec ls -l' It says
"find: missing argument to `-exec'"

Please help.

Thanks
Gaby

[Ivan Ferreira]

Yes you can. Just consider that enabling audit on files will cause a performance degradation. You should audit only what you really need to audit.

Check this link:

http://forums13.itrc.hp.com/service/forums/questionanswer.do?admit=109447627+1253890219156+28353475&threadId=1041575

[Don Mallory]

If you are looking for an immediate response, yes, auditd and possibly acct (process level accounting).

If you are just looking for a daily / weekly report, check out AIDE. It's installed by default. Will require initialisation, and you will be need to tweak the config for things you expect to change, but it will definitively tell you what has changed on the host.