log any changes to the system file

[HaiNguyen]

Hello,

I am new to Linux and is currently taking a course for the class, I was assigned a project of finding or creating a script of my choice that can be executed with administrative rights. I've chosen to create a script that would log any changes to the system file and send the log to a specific location. Could anyone one direct on where to begin? I've spent several days researching and trying to understand what shell script is all about, unfortunately I am still very new at this. While my professor doesn't really teach me much, I hope I can learn more here.

[Irithori]

Well, to be picky, there are more than one system fileS.

The forum rules forbid homework questions, but you are asking about general directions, which is ok-ish.

I see four approaches:
1) *file integrity* scanners. Just look for them at the usual places: freshmeat, sourceforge, your package manager
2) self written script, using *hash functions*.
Basically reinventing existing file integrity scanners.
The scope would probably have to be limited, though. As a full blown implementation is non-trivial.
3) real time. There is a kernel feature to *notify* the userspace about *inode* changes.
4) package manager: verify existing files against what the package manager thinks is installed (aka: has in its database)

Have fun googling


As for bash scripting:
Advanced Bash-Scripting Guide

[HaiNguyen]

thank you very much.