Saturday, September 16, 2017

Auditing file changes in Linux

Audit the file by adding a watch, tail the audit log, remove the watch and list current watches in case you need to remove others.
sudo auditctl -w /path/to/file -p wa
sudo tail -f /var/log/audit/audit.log
sudo auditctl -W /path/to/file -p wa
sudo auditctl -l

Followers