How to monitor init scripts in /etc/init.d/ in rhel 5
 

Hello Friends,

How can we track if someone executes any script in /etc/init.d/ directory with start / stop / restart option on a server ?
The requirement is to track the event and report it to some file like /var/log/messages or any other as applicable.

I am trying the same via auditctl but, have still not got it right.

Any help would be appreciated.

First of all; a user can't stop|start|restart a service with out root privilege.

Enable sudo access and log privilege right to specific script. This will solve your problem.

Thanks for the reply. I have finally got it via auditctl