Auditing folder/directory access

mamed77 · 04-28-2014, 02:08 AM

Hello,

I have a folder on my linux box where some PDF documents are generated. Is there ta way to configure read/write access auditing of the folder and send these audits to syslog ?

Thank you and

rgds,

mamed77

ericson007 · 04-28-2014, 02:11 AM

Dansguardian or tripwire?
They will check and alert on checksum changes and new files and deleted files.

They will aldo monitor the whole system. Useful for intrusion detection.

mamed77 · 04-28-2014, 02:19 AM

Can they monitor access to files? i.e. when a file is read or copied, the username and IP address of the user who access the file?

Linux audit system does not have this feature ?

Thanks for your quick reply.

Rgds,

mamed77

unSpawn · 04-28-2014, 01:06 PM

Quote:

Originally Posted by mamed77

I have a folder on my linux box where some PDF documents are generated. Is there ta way to configure read/write access auditing of the folder and send these audits to syslog ?

In real time (I guess that's what you want) and in random order:
- the audit service daemon,
- LoggedFS (FUSE-based),
- inotifywait,
- Samhain.

szboardstretcher · 04-28-2014, 01:28 PM

And to collect the syslogs centrally, I use Graylog, ElasticSearch and Rsyslog.

ericson007 · 04-28-2014, 07:26 PM

Dear goodness, I appologize for the dansguardian reference before, should have been samhain. Sorry guys. Dansguardian won't do what you are after.