BASH script to audit changes to files and/or directories.

[mrwizard]

Hi,

I'm new to this forum so excuse if my problem has been solved in previous thread.

I want to audit changes to files and/or directories.

Eg. monitor file httpd.conf, if edited or deleted, then write date;username;filename;host ip address to log file

Any ideas?

[Cabhan]

I don't believe this can be done. You could certainly do _some_ of this, but not all.

There is a library called inotify that allows a C program to receive events detailing when certain things happen to a file. For your particular case, you could be alerted whenever a given file is modified or is deleted (or renamed). However, I don't know how to get the username of the user who did that, and as for IP address, that would involve some sort of interfacing with sshd, which would be rather difficult.