Monitor file system changes

First install the aide file monitoring tool

Yum Install Aide-y

/etc/aide.conf configuration file

3 @ @define Dbdir/var/lib/aide

4 @ @define Logdir/var/log/aide above is its variable

7 database=file:@@{dbdir}/aide.db.gz is compressed in. GZ format, which is the compressed database storage location under the/var/lib/aide directory.

12database_out=file:@@{dbdir}/aide.db.new.gz file output.

Gzip_dbout=yes file compression format is compressed in gzip format, default Yes

Up to 5 copies of Verbose=5 system files are retained .

Report_url=file:@@{logdir}/aide.log log File

The following are definitions of which directories or files are monitored:

88/boot NORMAL

89/bin NORMAL

90/sbin NORMAL

91/lib NORMAL

92/lib64 NORMAL

93/opt NORMAL

94/USR NORMAL

95/root NORMAL

behind the the NORMAL meaning is described in the configuration file, and I'll give you an example here:

--NORMAL = r+rmd160+sha256

this also available in the detailed configuration file for R, see below:

54#r:p+i+n+u+g+s+m+c+acl+selinux+xattrs+md5

55#l:p+i+n+u+g+acl+selinux+xattrs

56#e:empty Group

57#>: Growing Logfilep+u+g+i+n+s+acl+selinux+xattrs

The following explanations of P are also:

28#p:permissions

29#i:inode:

30#n:number of links

31#u:user

32#g:group

33#s:size

34#b:block Count

35#m:mtime

36#a:atime

37#c:ctime

38#s:check for growing size

39#acl:access Control Lists

Of course, these are just some of the features and information, there are some more related information in the configuration file.

In other words, just write it back. NORMAL, you can monitor a lot of information you want to monitor, such as permissions, file size, owner, own group and so on.

If you don't want to monitor it, add it in front of your file! ( exclamation mark) can be, for example:

#These is too volatile

97!/usr/src

98!/usr/tmp

Aide--init Build database

Aide--check Monitor to check if the file is maliciously modified (the newly generated database file must be modified, otherwise the command will be prompted to be read, but the database file is required)

/dir Monitor all files and directories under this catalogue and directory

=/dir only monitors the directory itself and does not monitor the following sub-directories

! /dir Skip this directory, do not monitor this directory

This article from "Silence" blog, declined reprint!

Monitor file system changes