I'm curious if anyone has a suggestion to log only file move operations specifying the source and destination of the move.

I believe auditd has some functionality here, but I'm trying to stay away from maintaining a db to track changes, as the fs I want this on is rather large.

Auditd may be an option if there's a way I can add new files to the db upon creation without having to scan the fs and rebuild the db.

Thanks, M


inotify-tools appears to address the issue, e.g.,:

# recursively wait on directory for any events where files are moved to it 
inotifywait -m -r -e moved_to /root/notify/test1 | 
 while read f; do                                   # when an event occurs
  LOC=`echo $f | awk '{print $1$3}'`                # construct the new path to file
  GRP=`stat -c "%G" $(echo $f | awk '{print $1}')`  # query the parent folders group
  chgrp -Rv "$GRP" "$LOC" && 
   echo "success for grp change on $GRP for $LOC"   # change group ownership of object to parent

source : https://github.com/rvoicilas/inotify-tools

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.