Auditing system files

(via www.cyberciti.biz)

How do I audit file events such as read / write etc? How can I use audit to see who changed a file in Linux?

The answer is to use 2.6 kernel’s audit system. Modern Linux kernel (2.6.x) comes with auditd daemon. It’s responsible for writing audit records to the disk. During startup, the rules in /etc/audit.rules are read by this daemon. You can open /etc/audit.rules file and make changes such as setup audit file log location and other option. The default file is good enough to get started with auditd.

Comments

Comment viewing options

Select your preferred way to display the comments and click "Save settings" to activate your changes.
Auditing TTY

Nice set of audit rules along with keyboard logging at halfface.se wiki.

Comment