I would like to set up a daemon or something that logs all changes to a certain part of the filesystem. I have a particular directory that is the main "storage" area for all the users who access the server.
What I would like to log is:
- The filename and path that was modified (modified = added, changed, deleted).
- When the change was made
- What user made the change

This would help track down accidental moves and or deletions.
It would also add a bit of auditing to see who is doing what where.

I know that ext3 is a journaling fs, but it sounds like the journal is only written for a particular operation and then once the transaction is complete, the journal entries are deleted. Is there a way to connect this to a archive of changes and tag it with the information I would like to store?

As always, any tips are greatly appreciated.

Ziv

Also, the users connect to the server via Samba from windows machines.

I know tripwire can monitor file changes, perhaps you could configure it also to monitor directory changes?

Tripwire sounds interesting. I will do a little research.

Is anyone here using it?
I could use some hints before I RTM.

Thanks,
Ziv

Tripwire works pretty well (though it has trouble compiling from source on some distros). Aide, samhain, afick are a few others. There are actuallly even more listed in the security references thread .