linux auditing

kurrupt · 03-06-2013, 04:55 PM

Hey everyone,

I am looking to get some sort of auditing tool for linux that can track file system changes, folder access, logins etc...if that even exits?

Thanks again!!

Kustom42 · 03-06-2013, 05:16 PM

/var/log/audit on a rhel system should show you what you want as far as user audits. What distro are you looking for? Most should be able to install the auditd daemon.

chrism01 · 03-06-2013, 06:16 PM

Loosely speaking, /var/log/secure for for logins, /var/log audit for SELinux.
You could look at the logwatch tool, which has a lot of options and sends you an email eg daily.
See also psacct http://www.cyberciti.biz/tips/howto-...ccounting.html

Depending on EXACTLY what you need to monitor, you'll likely need multiple tools.

kurrupt · 03-07-2013, 12:23 PM

Quote:

Originally Posted by Kustom42

/var/log/audit on a rhel system should show you what you want as far as user audits. What distro are you looking for? Most should be able to install the auditd daemon.

REHL 5 and 6

unSpawn · 03-08-2013, 01:33 AM

...additionally

Quote:

Originally Posted by kurrupt

track file system changes, folder access, logins etc..

if you can be more precise about what you want to log you might get more specific do / don't replies. So please elaborate.

kurrupt · 03-30-2013, 10:50 AM

Quote:

Originally Posted by unSpawn

...additionally

if you can be more precise about what you want to log you might get more specific do / don't replies. So please elaborate.

Sorry!. yes I would like to track files and folders that are edited.

So if someone where to delete a file, it would track the user, time, which file (if this even possible).