Super User is a question and answer site for computer enthusiasts and power users. It's 100% free, no registration required.

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I am trying to use auditd to monitor changes to a directory. The problem is that when I setup a rule, it monitors the directory I specified, but also all the subdirectories and files underneath it, making the monitoring useless due to endless verbosity.

Here is how I setup the rule:

auditctl -w /home/raven/public_html -p war -k raven-pubhtmlwatch

When I search the logs using

ausearch -k raven-pubhtmlwatch

I get thousands of lines from the logs that list everything under public_html.

How can I limit the rule to changes on the directory specified only?

share|improve this question
1  
also asked here: stackoverflow.com/q/19031898/7552 – glenn jackman Sep 26 '13 at 16:30
up vote 4 down vote accepted

Credit goes to Steve @ redhat who answered my question on the linux-audit mailing list:

A watch is really a syscall rule in disguise. If you place a watch on a directory, auditctl will turn it into:

-a exit,always -F dir=/home/raven/public_html -F perm=war -F key=raven-pubhtmlwatch

The -F dir field is recursive. However, if you just want to watch the directory entries, you can change that to -F path.

-a exit,always -F path=/home/raven/public_html -F perm=war -F key=raven-pubhtmlwatch

This is not recursive and just watches the inode that the directory occupies.

I had to add the rule manually in /etc/audit/audit.rules then restart auditd with

/etc/init.d/auditd restart

now the rules are added and it works great!

share|improve this answer

Ubuntu 12.04 does not seem to behave in the same way w/r to system objects. Try putting this watch on /etc or /usr/lib (In another post there appears to be issues trying to watch top level directories). Then create something in one of those directories and nothing shows up in audit.log with the keyword. This items relates to testing of PCI DSS 3.1 10.2.7.

share|improve this answer

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.