Breaking News: Grepper is joining You.com. Read the official announcement!

auditctl monitor log file entries

Jason M Potter answered on November 8, 2022 Popularity 5/10 Helpfulness 2/10

answer auditctl monitor log file entries

auditctl monitor log file entries

Comment

# Live Rule Example
auditctl -w /etc/hosts -p war -k monitor-hosts
#	-w inserts a watch for the file system object at path, i.e. /etc/hosts.
#	-p sets permissions filter for a file system watch.
# 	The permission are any one of the following:
#       r - read of the file
#       w - write to the file
#       x - execute the file
#       a - change in the file's attribute
#	-k sets an arbitrary filter key name to identify the rule

# Permanent Rule Example, add to audit.rules log file.
-w /etc/hosts -p a -k monitor-hosts
# 	RHEL 4: /etc/audit.rules
#	RHEL 5: /etc/audit/audit.rules
#	RHEL 6: /etc/audit/audit.rules
#	RHEL 7: /etc/audit/rules.d/audit.rules
#	RHEL 8: /etc/audit/rules.d/audit.rules
#	RHEL 9: /etc/audit/rules.d/audit.rules

Popularity 5/10 Helpfulness 2/10 Language shell

Source: access.redhat.com

Tags: auditing file linux monitor shell

Link to this answer
Share Copy Link