Server Fault is a question and answer site for system and network administrators. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top


I have several sites and two users who work on them and sometimes update.

Instead of enabling/disabling the users when the site go live i trust them and assume they wont break my site.

However hackers do exist so i would like an app to alert me when there are changes (i plan to watch all sites that have gone live) so i can check what files are changed and to look at vandalism on the site(s).

The tool should preferably email me.

Bonus if it can tell me when my HD is getting low but i expect to use another tool for that.

share|improve this question
Please specify which OS. – Mark Wagner Sep 27 '10 at 22:13

You probably want a host based intrusion detection system (IDS) like tripwire since your intent is security. This will generate checksums of files based on the contents. If the file changes next time they are scanned the checksum will differ and will alert you that the file has changed.

You may have noticed that some programs you download contain a md5 hash near the link. This is so you can verify the file integrity. The principle with trip wire is the same.

share|improve this answer
I found this a useful resource when setting up tripwire. – ringmaster Apr 16 '15 at 15:00

If you are using Linux, incron will watch files in directories you designate or inotifywait can watch files recursively. Any action can be taken when there are changes.

share|improve this answer

Not sure whether this is a Linux question. If it is, you can use basically any tool that interfaces with the inotify subsystem of the Linux kernel. Such as, for example, iwatch:

share|improve this answer

You want AIDE - an intrusion detection system. It scans the directories you tell it to, to build up a database of md5 hashes. Then you run it regularly, or on-demand to create another DB which it compares to the original. Differences are reported to you. then you can make the new DB into the baseline and repeat.

You don't have to check file changes, it'll report on permission updates and other items as well. The report it produces is a text file that can be emailed after a run - google for examples.

Its free and OSS.

share|improve this answer

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.