Tell me more ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.
up vote 0 down vote favorite

I've been wondering as to how can I track changes done to files located at certain directory (including subdirectories if any). I am specially interested in file modifications rather than read/delete/execute. After some internet research (mainly here) I've discovered that auditctl tool can be used for that purpose. However from the examples I've found, it seems that only the following information will be available:

  • User ids
  • Command used to access the "watched" file
  • Operation for which the file was opened (read/write/...)

Now, in my case, I want to know what were the exact changes done to a file. For example, if some content was deleted/added/modified, I want to know exactly what was deleted/added/modified. So it seems that I need a different tool here.

share|improve this question

2 Answers

up vote 0 down vote

Maybe there are more interesting ways to do this with configuration management (Puppet) or a monitoring tool like Monit or Nagios, but the first product that comes to mind is Tripwire. - http://sourceforge.net/projects/tripwire/

Also see: What tool do you recommend to track changes on a Linux/Unix server

share|improve this answer
Thank you for your recommendations. I will definitely take a look. But before I do I wanted to ask which one of these tools is the less intrusive to the system? I mean that the system I work on is a customer system and I don't want to make any serious modifications on the there. Originally I'd prefer a RHEL built-in solution. This was the main reason why I started with auditd tool. – Eugene S Mar 1 '12 at 8:10
up vote 0 down vote

You can also look at OSSEC. It can monitor file changes and other system activity

share|improve this answer
Thank you for your recommendation, however what I'm looking for is a bit more simple solution where I won't have to install agents on several machines. Preferably, RHEL built-in tool. – Eugene S Mar 1 '12 at 8:06

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.