Monitoring the remote Changes Made?

your_shadow03 · 09-11-2008, 11:49 PM

hello Guys,

I want to ask you something very interesting and i hope you gonna Help me with.I have three users performing administrative job under my supervision.Whenever they do something and if it goes wrong I am unable to track who did it wrong.I can see the history command but that gives me only commands not file changes he make.Ony file name can be seen and nothing more in history command.

is there any tool which can show me each and every changes performed per user ?

Do Suggest me.

i92guboj · 09-12-2008, 12:35 AM

I don't know of a more complete answer, but...

You can try

Code:

inotifywait -mr --format '%T: %w %f %e' --timefmt '%c' /

The only downside of this is that I know no way to show the user name. However, maybe you can use this in conjunction with the shell history to determine the guilty

You can change the directory, or even launch multiple monitors for many dirs if you want. You could very well redirect that to a log file (>) so you can review it later or use it for forensic purposes.

I'd be interested as well in a better solution, but for now I know none.