Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

I need to set up auditing in my environment, specifically file integrity monitoring. I've tried OSSEC, but found it cumbersome. I've since discovered auditd (already installed on my CentOS 6 system) and found it to be a simple but powerful auditing solution.

I'm aware of the command line tool aureport for generating stats or lists of file changes recorded by auditd, and it works nicely. However, I've got about 100 Linux hosts currently, and need to find a smoother way to be alerted to changes to critical files. Are there any open source reporting tools or dashboards out there that sit on top of auditd for aggregating multiple hosts on a network? I haven't seen anything when searching the net and github.

As a bonus, it would be convenient to have the file changes reported by auditd to be combined with file change reports from puppet reports from the puppetmaster/puppetDB host to show that a change was expected and to not fire an alert or be shown in the report.

Any recommendations on existing solutions or tips on this file integrity monitoring topic?

share|improve this question

closed as off-topic by dawud, mdpc, Dave M, TheCleaner, Ward Sep 17 '13 at 2:12

This question appears to be off-topic. The users who voted to close gave this specific reason:

  • "Questions seeking product, service, or learning material recommendations are off-topic because they tend to become obsolete quickly. Instead, describe your situation and the specific problem you're trying to solve." – dawud, mdpc, Dave M, TheCleaner, Ward
If this question can be reworded to fit the rules in the help center, please edit the question.

add comment

1 Answer

Recent versions of auditd have a dispatcher that supports sending events to syslog so you can perform the processing through your centralized logging system (assuming you have one).

Edit: puppet supports syslog as a log dest so you could do correlation there as well.

share|improve this answer
add comment

Not the answer you're looking for? Browse other questions tagged or ask your own question.