I am trying to use auditd to monitor changes to a directory. The problem is that when I setup a rule, it monitors the directory I specified, but also all the subdirectories and files underneath it, making the monitoring useless due to endless verbosity.

Here is how I setup the rule:

auditctl -w /home/raven/public_html -p war -k raven-pubhtmlwatch

When I search the logs using

ausearch -k raven-pubhtmlwatch

I get thousands of lines from the logs that list everything under public_html.

How can I limit the rule to changes on the directory specified only?


Credit goes to Steve @ redhat who answered my question on the linux-audit mailing list:

A watch is really a syscall rule in disguise. If you place a watch on a directory, auditctl will turn it into:

-a exit,always -F dir=/home/raven/public_html -F perm=war -F key=raven-pubhtmlwatch

The -F dir field is recursive. However, if you just want to watch the directory entries, you can change that to -F path.

-a exit,always -F path=/home/raven/public_html -F perm=war -F key=raven-pubhtmlwatch

This is not recursive and just watches the inode that the directory occupies.

I had to add the rule manually in /etc/audit/audit.rules then restart auditd with

/etc/init.d/auditd restart

now the rules are added and it works great!


Ubuntu 12.04 does not seem to behave in the same way w/r to system objects. Try putting this watch on /etc or /usr/lib (In another post there appears to be issues trying to watch top level directories). Then create something in one of those directories and nothing shows up in audit.log with the keyword. This items relates to testing of PCI DSS 3.1 10.2.7.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.