I've been wondering as to how can I track changes done to files located at certain directory (including subdirectories if any). I am specially interested in file modifications rather than read/delete/execute. After some internet research (mainly here) I've discovered that
auditctl tool can be used for that purpose. However from the examples I've found, it seems that only the following information will be available:
- User ids
- Command used to access the "watched" file
- Operation for which the file was opened (read/write/...)
Now, in my case, I want to know what were the exact changes done to a file. For example, if some content was deleted/added/modified, I want to know exactly what was deleted/added/modified. So it seems that I need a different tool here.