On 07/20/2015 07:08 PM, Steve Grubb wrote:
On Monday, July 20, 2015 09:53:47 PM Burn Alting wrote:
I am interested in any Linux based capability that will monitor
identified files and report on actual changes to the monitored file.
I know of nothing that does this. But as long as the list of files is limited,
it doesn't sound like a hard program to write.
Any one else with an opinion?
Yes :-) I'm not so sure it's an easy program to write and be robust in a
variety of scenarios. I know because I wrote such a program once. The
basic problem is most people think in terms of monitoring a file by name
(e.g. it's pathname). But inotify operates on inodes, not filenames. If
that file is subject to any variety of log rotation strategies or
modifications by a configuration manager whereby the file is renamed or
moved to a different directory then any program using inotify to monitor
the file needs to become reasonably sophisticated and be able to track
those changes. It is entirely possible for two processes to have opened
the same file by name but have them be 2 different files (e.g. after
opening the file path is modified but the process still has the original
inode open, now a 2nd process opens the same filename but gets a
different inode). Conflating inodes with filenames can lead to
unexpected results and if the purpose is some sort of security
monitoring it will be important these issues are accounted for.
Some of this is discussed in these documents which accompany the lwatch
(Log Watch) program I wrote:
https://jdennis.fedorapeople.org/lwatch/html/InotifyOverview.html
https://jdennis.fedorapeople.org/lwatch/html/LogWatchOverview.html
--
John
--
Linux-audit mailing list
[email protected]
https://www.redhat.com/mailman/listinfo/linux-audit
