I haven't test it but for unix systems maybe you can create rules to read stat command output
On Tue, Jul 14, 2015 at 9:24 AM, theresa mic-snare <[email protected]> wrote: > Hi, > > i'm not sure if I understood the request/question completely...but it does > sound a bit complicated to me. > how would you do this? > the user management is different on some platforms, e.g unix systems vs. > windows systems. > > for which platform do you want it? what sort of logs are we even talking > about it? > i'm not sure if user-based file-changes are currently logged on unix > systems (maybe in an audit log?!?) > > Am Dienstag, 14. Juli 2015 14:25:48 UTC+2 schrieb dan (ddpbsd): >> >> >> On Jul 14, 2015 7:22 AM, "Arun Kumar" <[email protected]> wrote: >> > >> > Hi Team, >> > >> > How to display user info in log when specific file or log get changed >> as who changed/modified the file >> >> OSSEC has no facility to do this. Where is that information stored? Maybe >> someone else wants this feature bad enough to work on it? >> >> > >> > Is there any workaround for the same. >> > >> > Thanks and Regards, >> > Arun >> > >> > -- >> > >> > --- >> > You received this message because you are subscribed to the Google >> Groups "ossec-list" group. >> > To unsubscribe from this group and stop receiving emails from it, send >> an email to [email protected]. >> > For more options, visit https://groups.google.com/d/optout. >> > -- > > --- > You received this message because you are subscribed to the Google Groups > "ossec-list" group. > To unsubscribe from this group and stop receiving emails from it, send an > email to [email protected]. > For more options, visit https://groups.google.com/d/optout. > -- --- You received this message because you are subscribed to the Google Groups "ossec-list" group. To unsubscribe from this group and stop receiving emails from it, send an email to [email protected]. For more options, visit https://groups.google.com/d/optout.
