{"id":3374,"date":"2010-07-15T23:33:59","date_gmt":"2010-07-16T03:33:59","guid":{"rendered":"http:\/\/g33kinfo.com\/info\/?p=3374"},"modified":"2010-07-15T23:33:59","modified_gmt":"2010-07-16T03:33:59","slug":"how-to-use-auditd-to-track-file-changes","status":"publish","type":"post","link":"https:\/\/g33kinfo.com\/info\/how-to-use-auditd-to-track-file-changes\/","title":{"rendered":"How to use auditd to track file changes"},"content":{"rendered":"

From lazyscripter.com<\/a><\/p>\n

Alright, here\u2019s a post for the advanced Linux users that doesn\u2019t have time to mess around. Have you ever wanted to track what accesses a file on your server? Using the auditd daemon, you can do just that.<\/p>\n

Is auditctl installed?<\/strong>
\n
\n[root@eclipse ] ~ # which auditctl
\n\/sbin\/auditctl
\n<\/code><\/p>\n

How to install auditctl<\/strong>
\nIf your output is blank, or shows an error message, you may need to install the audit package.
\n
\n[root@eclipse ] ~ # yum -y install audit
\nRunning auditd on boot
\n[root@eclipse ] ~ # chkconfig auditd on
\n[root@eclipse ] ~ # ntsysv
\n<\/code>
\nYou\u2019ll see a screen like this:<\/p>\n

ntsysv<\/p>\n

\nJust make sure auditd has a star, then hit once to go to the \u201cOk\u201d button, and hit Enter to save.<\/p>\n

After you save, be sure to start the auditd daemon by executing:
\n
\n[root@eclipse] ~ # \/etc\/init.d\/auditd start
\nStarting auditd: [ OK ]
\n<\/code><\/p>\n

Setting up a file watch<\/strong>
\nTo setup a file watch, you\u2019ll need 3 things:<\/p>\n