Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

I am looking for some software to monitor local file systems on some Linux servers. It can be commercial or FOSS as cost is not an issue. The systems are running ubuntu Server 8.04 x86. I would like the software to be able to be able to write to a log file or display in real time to the terminal. I am also interested in software that has a GUI component so that less technical users can quickly review the logs and add and remove files and directories and change the type of file system events they are interested in.

share|improve this question

closed as off-topic by Magellan, TheCleaner, mdpc, Nathan C, Falcon Momot Sep 5 '13 at 13:09

This question appears to be off-topic. The users who voted to close gave this specific reason:

  • "Questions seeking product, service, or learning material recommendations are off-topic because they tend to become obsolete quickly. Instead, describe your situation and the specific problem you're trying to solve." – TheCleaner, mdpc, Nathan C, Falcon Momot
If this question can be reworded to fit the rules in the help center, please edit the question.

    
What are you trying to monitor? Usage, errors, or something else? If all you are trying to do is display disk usage you can use watch to display the output of du or df. –  Rik Schneider Aug 11 '09 at 23:47
    
We have a couple for reasons. Things like config file changes for automatic versioning, log file activity and some file usage monitoring. –  Tim Aug 11 '09 at 23:53

5 Answers 5

up vote 2 down vote accepted

You could start with auditd and see if that fits your requirements. Here you can find a quick introduction.

Maybe you could also use a general purpose monitoring tool like Nagios, but that depends on what you want to monitor.

For log file monitoring, you can try logcheck and phpLogCon.

With regard to configuration changes and versioning, etckeeper can be a good starting point. Or you could go for a configuration management system like Puppet.

share|improve this answer

I'm a really big fan of OSSEC. It's Open Source and it implements a HIDS and LIDS. You can create custom rules to alert you on the logs that it parses through. So you can get alerted on as little or as much as you want.

share|improve this answer

If you look to check filesystem integrity, you may use iwatch a perl script based on inotify, that monitor the filesystem's integrity in realtime and will send alarm immediately to the system administrator when there is any changes in the monitored filesystem.

May be you need to monitor filesystem activities for that you have to check some monitoring solution like nagios that comes with a huge of pluging.

share|improve this answer

Tripwire - Open Source Tripwire is a free software security and data integrity tool useful for monitoring and alerting on specific file change(s) on a range of systems. The project is based on code originally contributed by Tripwire, Inc. in 2000. Open Source Tripwire functions as a host-based intrusion detection system. Rather than attempting to detect intrusions at the network interface level (as in network intrusion detection systems), Open Source Tripwire detects changes to file system objects. When first initialized, Open Source Tripwire scans the file system as directed by the administrator and stores information on each file scanned in a database. At a later date the same files are scanned and the results compared against the stored values in the database. Changes are reported to the user. Cryptographic hashes are employed to detect changes in a file without storing the entire contents of the file in the database. While useful for detecting intrusions after the event, it can also serve many other purposes, such as integrity assurance, change management, and policy compliance.

The commercial version is here: link

I think this is what you are looking for...unless you are looking for disk usage activity.

share|improve this answer

iwatch

Description: realtime filesystem monitoring program using inotify iWatch is a realtime filesystem monitoring program. It's a simple perl script to monitor changes in specific directories/files and send email notification immediately. It reads the dir/file list from xml config file and needs inotify support in kernel (Linux Kernel >= 2.6.13). Homepage:http://iwatch.sourceforge.net/

share|improve this answer

Not the answer you're looking for? Browse other questions tagged or ask your own question.