Re: Configuration file monitoring - reporting content changes

2015-07-20 Thread Steve Grubb
On Monday, July 20, 2015 09:53:47 PM Burn Alting wrote: > I am interested in any Linux based capability that will monitor > identified files and report on actual changes to the monitored file. I know of nothing that does this. But as long as the list of files is limited, it doesn't sound like a h

Re: Configuration file monitoring - reporting content changes

2015-07-20 Thread Burn Alting
Gary, Thanks. Although quite comprehensive about raising an alert when a large variety action occur to a file, it still doesn't give me the core requirement of reporting what content has changed. At best, one could use the 'execute a command option' to, say do a diff on certain actions, but you wo

Re: Configuration file monitoring - reporting content changes

2015-07-20 Thread Smith, Gary R
Hello Burn, Have you considered iwatch (no, not the Apple wrist gadget). It monitors files and can alert on a large set file conditions. Check out this man page at: http://manpages.ubuntu.com/manpages/utopic/man1/iwatch.1.html Best regards, Gary Smith On 7/20/15 4:56 AM, Burn Alting wrote: > Al

Re: [PATCH V6 1/4] audit: implement audit by executable

2015-07-20 Thread Paul Moore
On Friday, July 17, 2015 04:46:18 PM Richard Guy Briggs wrote: > On 15/07/17, Paul Moore wrote: > > You could do a "based on" or similar tag if you want. I'm honestly not > > sure what the official tags are beyond signed-off, acked, and reviewed. > > Those are the only ones I really care about an

Re: Configuration file monitoring - reporting content changes

2015-07-20 Thread Burn Alting
Mon, 2015-07-20 at 21:09 +0900, Tetsuo Handa wrote: > Burn Alting wrote: > > All, > > > > I am interested in any Linux based capability that will monitor > > identified files and report on actual changes to the monitored file. I > > know there are methods of recording that the file has been change

Configuration file monitoring - reporting content changes

2015-07-20 Thread Burn Alting
All, I am interested in any Linux based capability that will monitor identified files and report on actual changes to the monitored file. I know there are methods of recording that the file has been changed (e.g. aide and/or monitor writes via auditd), but I want to know what has changed ... basic