Tell me more ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.
up vote 0 down vote favorite

There exists some high-level wrappers for system file events, for here it is an example of usage of Listen ruby gem:

Listen.to('some/path', 'some/another/path', :filter => [/\.tmp$/]) do |modified, added, removed|
  ...
end

Does there exist such thing for monitoring, for example, "permission denied" events?

share|improve this question

1 Answer

up vote 1 down vote accepted

FreeBSD: Yes, as usual the Handbook is your friend. Handbook: Security Event Auditing.

Linux: It depends on what you're looking for, Linux doesn't have a simple interface like FreeBSD, but you can get all the same information. Depending on what you're looking for it may be distro and version specifc too. The information may be different across distros. So, 'it depends' is the best I can give you.

share|improve this answer
it looks like FreeBSD's security web auditing is, from the point of view of the level of abstraction, is closer to staff like inotifywait - this is far from closs-platform wrapper this question is about ) Thank you for the link, nevertheless! – shabunc Jul 31 '12 at 10:54
What you're asking for, a cross-platform abstraction, doesn't exist as such. – Chris S♦ Jul 31 '12 at 12:55
just to make thing clearer to me - such thing does not exists because it's too complicated to implement this or this is just because nobody needs such functionality? – shabunc Jul 31 '12 at 12:57
1  
The various platforms have such different auditing capabilities that comparing the audit events is almost impossible. It would be possible to simply collect all the various events. But the BSDs, Solaris, Linux, Unix, and Windows all have different types of events, different attributes that are kept for each event, and different formats/facilities for recording them. Most environments are homogeneous enough that monitoring can concentrate on a single method, so while some people would like such functionality, it's not common enough for something to be out there already. – Chris S♦ Jul 31 '12 at 13:00

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.