Hi, everyone
I would like to write ksh script in ksh (HP-UX), to audit any changes inside target directories.
My enviroment has many constrains, so I can only use ksh and cannot install
any 3rd party soft or command (include perl or other languages)
The script functions like below
1) take a snapshot of the target directory (recursive with the directory inside, like ls -ailR target_dir)
2) log any changes(compare with snapshot) that been added, deleted or modified(include chmod) and seperatly store into log.add, log.del, log.mod
3) this script will excute in crontab once a day
note: maybe could use the cmd "dircmp" to compare two directories, but it's hard to make the snapshot if the directory size is huge
I've already search the related articles both in forum and google.
I do find something ... but due to the constrains of my enviroment,
it's far from complete the goal to finish the script (new to ksh, used to coding in perl)
There are some programs exactly the function I need, like open source
EICS - Easy Integrity Check System
or
L5 => infossies.org/unix/misc/old/L5.tgz, and commercial soft
tripwire
Unfortunately, I cannot find the same functaion wrote in script (still researching
Hope someone can help to complete this script
I'll be very appreciate the effert you've done.
Thanks in advanced.
Stev.H
Thanks to the original author Steven Koh(id : izy100)
I've modified the code as follow
Code:
#!/usr/local/bin/ksh93
#
# UNIX Monitor Script
# Purpose: Monitors the changes in a directory
# Outputs: Log file
# Author : Steven Koh
# Modified by Stev.H
#*********************************************************
#
if test $# -lt 1; then
echo "Usage: $0 <DIR TO MONITOR FOR NEW FILES>"
echo "Example: $0 /var/tmp"
echo
exit 0;
fi
MONITOR_DIR=$1
LOG_DIR="log"
NEW_LOG="${LOG_DIR}/mon_file.log"
OLD_LOG="${LOG_DIR}/mon_file.old"
ADD_FILE="${LOG_DIR}/mon_file.add"
DEL_FILE="${LOG_DIR}/mon_file.del"
if test ${MONITOR_DIR}="./"; then
MONITOR_DIR=`pwd`
fi
if [[ -d $LOG_DIR ]]; then
#if directory log exist then print nothing
print
else
mkdir ${LOG_DIR}
fi
touch ${NEW_LOG}
mv ${NEW_LOG} ${OLD_LOG}
print "============= `date` =============\n${MONITOR_DIR}:" | tee $NEW_LOG
unalias ls
ls -ailR ${MONITOR_DIR} | tee -a ${NEW_LOG}
#egrep -vf ${OLD_LOG} ${NEW_LOG} | grep -v "=============" > ${DIFF_FILE} 2>&1
comm -23 ${OLD_LOG} ${NEW_LOG} | grep -v "=============" > ${DEL_FILE} 2>&1
comm -13 ${OLD_LOG} ${NEW_LOG} | grep -v "=============" > ${ADD_FILE} 2>&1
if test `wc -l < ${DEL_FILE}` -gt 0; then
echo "Monitor files been deleted in ${MONITOR_DIR}"
echo "=================================="
echo
cat ${DEL_FILE}
elif test `wc -l < ${ADD_FILE}` -gt 0; then
echo "Monitor files been added in ${MONITOR_DIR}"
echo "=================================="
echo
cat ${ADD_FILE}
fi