auditd is the userspace component to the Linux Auditing System.

learn more… | top users | synonyms

6
votes
4answers
6k views

File audit in Linux: how to watch directory tree for deletions?

I have a forum script running on server and somehow small number of attachments begin to get lost. I want to find out what is deleting them and at what time. How can I setup Linux auditd (auditctl) to ...
2
votes
2answers
261 views

Problems getting auditd set up on my server

I'm trying to figure out which processes are deleting files from a specific directory, so I want to set up and run auditd on my system. I've set up the following rule in audit.rules: -w S unlink -S ...