I´m looking for a simple way to monitor critical folders for changes to recognize hacks on a ubuntu 12.04 server. After Days of reading How To´s on different programms I´m a bit confused which way to go. The candidates I´ve googled so far are:

  • Tripwire
  • Samhain
  • Iwatch
  • Ossec

As written all I need is a not ressource intense way to check if something changed on my system (if so send an emai).

Beside the 4 solutions I´ve read that Linux gives you already the possibility to monitor and inform about file changes with Upstart. It´s already included within ubuntu what makes it glittering for me. Unfortunately I couldn´t find any How to´s for Upstart file monitoring.

Last but not least, I could also imagine to set up a simple cronjob which compares f.e. the size of critical folders with a given size.

Thankful for pointing me in the right direction,


  • what exactly is your question? and an md5 sum is probably more reliable than a simple size chack for your cron. Jan 2, 2014 at 8:35
  • How many files are you trying to monitor? If it is few and they change infrequently, then performance is less of an issue. Also, if it is just one server, I would stick with a simple solution not requiring a centralized reporting tool. Jan 2, 2014 at 16:56

3 Answers 3


Although we're not supposed to do product recommendation, here are my inputs about samhain. I've been asked to study the best solution out of the whole open-source market on file integrity checkers, and Samhain ended up being the best, because it is feature-rich, open-source and actively developped.

You can tune the resource impact by :

  • Limit the I/O generated by initialisation/checks SetIOLimit=1000 (kB/s)
  • Define the process priority to reduce impact : SetNiceLevel=19
  • using simplier hashing algorithm will reduce CPU impact
  • Choosing only the attributes you find meaningful in the hashing process will reduce the included data
  • Limit to the files you want to monitor only.
  • reduce the frequency of file checks

Source : Official Documentation


On some cases i use yafic, which i very simplified file integrity checker.

But i prefer OSSec (cross platform,agent), as it can monitor log files and respond accordingly.

e.g monitor the secure log file for ssh brute force attack, or web server probing and block the ip address in some cases.

yafic is not in ubuntu repos, so you will need to compile it from source.


apt-cache search inotify, for more information about inotify interface "man inotify"

  • 2
    This answer deserves a bit more explanation of what is inotify, even it it means quoting the man page. That would be useful to people intrested in knowing more without installting stuff/having a server on hand.
    – mveroone
    Jan 2, 2014 at 9:48
  • @Kwaio if you don't have a server on hand, you can read the man pages of inotify online linux.die.net/man/7/inotify, some times i would like to help some body, but without so much times to explain about some thing, the man pages can help
    – c4f4t0r
    Jan 2, 2014 at 18:33
  • In those cases, consider making it a comment, not an answer =)
    – mveroone
    Jan 3, 2014 at 8:20

Not the answer you're looking for? Browse other questions tagged or ask your own question.