Server Fault is a question and answer site for system and network administrators. It's 100% free, no registration required.

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I'm working on a project which requires some auditing of read/write/modifications to various files. Additionally I must log ftp access, user logins, NTP/system time changes etc. Is there a nice tool for UNIX able to do all this and also allow me to export the data to a nice human readable format?

Right now I am monitoring file events using the standard UNIX audit tool with ausearch commands etc. This works OK, however it has a lot of guff and I don't particularly want to have to write scripts to parse all these files. I would also really like things to be written in a human readable format rather than have to parse it after the fact. Given our customer wants to be able to export these audit logs and read them with basic tools (web browser/text editors) i need it to be easy on the eye.

Any help on this one?


share|improve this question

File changes: AIDE

And for the logs: Logcheck
You can tweak it so it reports certain entries in logs.

share|improve this answer
Looked into AIDE, however I am under the belief that it cannot log file modifications/access/executions on the fly? It hashes all files configured to start with and can then be used for later comparison? Given that the system I am working on is recording CCTV footage, I need to be able to log any access to recorded footage which is being constantly generated. Terrabytes worth in-fact. I finally got auditd to do what I wanted, with logrotate handling log rollovers, which is great. But then I find that it will not recurse sub-directories, which I need it to do. Am I wrong or will AIDE do this? – user8680 Jun 10 '09 at 8:58
AIDE also check subdirectories. About monitoring CCTV footage I don't know a tool that would monitor on the fly. AIDE simply shows you changes, added files, and deleted files between previous and current snapshot. – Alakdae Jun 10 '09 at 9:07
As I suspected. Cheers for the info. My hunt shall continue! – user8680 Jun 11 '09 at 2:31

there is audit daemon on linux boxes.

share|improve this answer
This is my current implementation. The problem however is that it does not allow to much in the way of log file format. It is quite verbose, and not too human readable. There are lots of features that I would like it to have which it sadly does not. So if there is a tool out there that is better, that would be great. – user8680 Jun 8 '09 at 10:45

My recommendation is the tool OSSEC.

-It does file integrity checking to detect changes to files (or directories)

-It does log analysis to detect failed logins, time changes, etc

-It is open source, multi-platform and easy to install.

I have been using it for PCI compliance and to audit my Linux systems and routers (yes, it supports Cisco routers too via "agentless").


share|improve this answer

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.