<html><head></head><body><div style="color:#000; background-color:#fff; font-family:times new roman, new york, times, serif;font-size:16px"><div><span></span></div><div></div><div id="yui_3_16_0_ym19_1_1462809781234_3381">Hi Team,</div><div id="yui_3_16_0_ym19_1_1462809781234_3476"><br></div><div id="yui_3_16_0_ym19_1_1462809781234_3477">We have requirement where we have to monitor and log any read operations performed on a file. </div><div id="yui_3_16_0_ym19_1_1462809781234_3478"><br></div><div id="yui_3_16_0_ym19_1_1462809781234_3479">e.g. /a/b/c/xyz.log</div><div id="yui_3_16_0_ym19_1_1462809781234_3480"><br></div><div id="yui_3_16_0_ym19_1_1462809781234_3481" dir="ltr">This file is usually copied and downloaded by many users using various operations, like, wget, ssh, jsp Download link provided. These commands are fired from different hosts.</div><div id="yui_3_16_0_ym19_1_1462809781234_3482"><br></div><div id="yui_3_16_0_ym19_1_1462809781234_3483">With the auditd we want to create a rule which auditctl can leverage to log the User ID that is reading (and copying) it from a different host may be. I have gone through many of the rules but didn't find anything fruitful as such (<strong id="yui_3_16_0_ym19_1_1462809781234_3532">which logs wget, scp commands from remote hosts</strong>). May be I am missing on something. Since it is a very crucial requirement, appreciate your guidance and directions with this.</div><div id="yui_3_16_0_ym19_1_1462809781234_3519"><br></div><div id="yui_3_16_0_ym19_1_1462809781234_3521">Let me know in case you require any further information from my end. Many thanks in advance.</div><div id="yui_3_16_0_ym19_1_1462809781234_3526"><br></div><div id="yui_3_16_0_ym19_1_1462809781234_3485"><br></div><div id="yui_3_16_0_ym19_1_1462809781234_3565"><br></div><div id="yui_3_16_0_ym19_1_1462809781234_3573"><br></div><div class="signature" id="yui_3_16_0_ym19_1_1462809781234_3486"><b id="yui_3_16_0_ym19_1_1462809781234_3489">Thanks and Regards,</b><div id="yui_3_16_0_ym19_1_1462809781234_3487"><b id="yui_3_16_0_ym19_1_1462809781234_3488">Varun Gulati</b></div><div id="yui_3_16_0_ym19_1_1462809781234_3548"><strong></strong><br></div></div></div></body></html>