-   Red Hat (
-   -   How to monitor init scripts in /etc/init.d/ in rhel 5 (

me_spearhead 02-08-2011 05:17 AM

How to monitor init scripts in /etc/init.d/ in rhel 5
Hello Friends,

How can we track if someone executes any script in /etc/init.d/ directory with start / stop / restart option on a server ?
The requirement is to track the event and report it to some file like /var/log/messages or any other as applicable.

I am trying the same via auditctl but, have still not got it right.

Any help would be appreciated.

prodev05 02-08-2011 05:42 AM

First of all; a user can't stop|start|restart a service with out root privilege.

Enable sudo access and log privilege right to specific script. This will solve your problem.

me_spearhead 02-09-2011 10:41 PM

Thanks for the reply. I have finally got it via auditctl

All times are GMT -5. The time now is 03:25 PM.