LinuxQuestions.org
Share your knowledge at the LQ Wiki.
Go Back   LinuxQuestions.org > Forums > Linux Forums > Linux - Security
User Name
Password
Linux - Security This forum is for all security related questions.
Questions, tips, system compromises, firewalls, etc. are all included here.

Notices

Reply
 
LinkBack Search this Thread
Old 12-02-2012, 09:49 PM   #1
Find
Member
 
Registered: Jan 2012
Posts: 31

Rep: Reputation: Disabled
Log all file and directory modifications


How do you log all file and directory modifications within a directory (recursively) in Linux. Is it possible to be alerted in real-time of a change in file-system? Is it possible to scan via clamscan a file after modification?
 
Old 12-03-2012, 05:22 AM   #2
bala.linuxtech
Member
 
Registered: Nov 2012
Location: Bangalore
Distribution: RHEL and Centos
Posts: 80

Rep: Reputation: Disabled
Quote:
Originally Posted by Find View Post
How do you log all file and directory modifications within a directory (recursively) in Linux. Is it possible to be alerted in real-time of a change in file-system? Is it possible to scan via clamscan a file after modification?
We can use stat command to check modifications ...
 
Old 12-03-2012, 05:38 AM   #3
unSpawn
Moderator
 
Registered: May 2001
Posts: 26,539
Blog Entries: 51

Rep: Reputation: 2604Reputation: 2604Reputation: 2604Reputation: 2604Reputation: 2604Reputation: 2604Reputation: 2604Reputation: 2604Reputation: 2604Reputation: 2604Reputation: 2604
Over the years we've seen many "I want to log everything" questions at LQ (one of the reasons we have search functionality ;-p) and your options include anything ranging from system call logging with the audit service, Inotify tools or FUSE LoggedFS to homebrewn kludges. See for instance this and this. If in essence you want a kernel module for the purpose of on-access scanning then kernel-2.4 LKM used Dazuko, developed by AVIRA (also see related developments) and kernel-2.6 (no idea if it works with kernel 3.x now) uses RedirFS, developed by GRISOFT and used by Comodo, KAV, AVG and other AV vendors. So there's no reason why ClamAV shoudln't be able to use it too.
 
Old 12-04-2012, 03:32 AM   #4
arun5002
Member
 
Registered: Aug 2011
Location: Chennai,India
Distribution: Redhat,Centos,Ubuntu,Dedian
Posts: 548
Blog Entries: 5

Rep: Reputation: Disabled
You can achieve these using inotify script .To Log modification of changes and even get alert when a newly files get created file or modified inside a directory.


These link may help you


http://www.infoq.com/articles/inotif...ent-monitoring

Last edited by arun5002; 12-04-2012 at 03:35 AM.
 
1 members found this post helpful.
  


Reply


Thread Tools Search this Thread
Search this Thread:

Advanced Search

Posting Rules
You may not post new threads
You may not post replies
You may not post attachments
You may not edit your posts

BB code is On
Smilies are On
[IMG] code is Off
HTML code is Off
Trackbacks are Off
Pingbacks are On
Refbacks are Off


Similar Threads
Thread Thread Starter Forum Replies Last Post
single bind mounted file out of sync after modifications capnroscoe Linux - General 0 07-27-2012 07:00 AM
after doing some modifications in aodv.cc file in ns2.34 i will get error breeze259 Linux - Newbie 1 01-05-2012 08:04 PM
Log file directory questions archer007 Linux - Newbie 2 12-02-2009 08:32 AM
Amsn log in-no file or directory? Cliff Fussell Linux - Newbie 2 01-15-2004 05:16 PM
Anyway to lock apache log file before I tar the directory? m3kgt Linux - General 2 11-05-2003 11:51 AM


All times are GMT -5. The time now is 07:06 AM.

Main Menu
My LQ
Write for LQ
LinuxQuestions.org is looking for people interested in writing Editorials, Articles, Reviews, and more. If you'd like to contribute content, let us know.
Main Menu
Syndicate
RSS1  Latest Threads
RSS1  LQ News
Twitter: @linuxquestions
identi.ca: @linuxquestions
Facebook: linuxquestions Google+: linuxquestions
Open Source Consulting | Domain Registration