1
vote
1answer
122 views

Auditd - auditctl rule to monitor dir only (not all sub dir and files etc..)

I am trying to use auditd to monitor changes to a directory. The problem is that when I setup a rule it does monitor the dir I specified but also all the sub dir and files making the monitor useless ...
0
votes
1answer
86 views

Linux network audit

I have a server with Linux Red-hat Enterprise Edition 5.4 installed. and a client/server application that permits connection at the port 6000, but it doesn't offer connections log. I want to know ...
1
vote
2answers
664 views

How do I find out when and by whom a particular user was deleted in linux?

I've recently ran into a very odd occurrence on one system I'm using. For no apparent reason, my user account was deleted, although the home directory is still there. I have root access, so I can ...