Util that tracks past changes to et4 filesystem?

[Mr. Paul M. Whitney]

Tripwire used to be free.  Whatever. Red Hat offers the free version called AIDE (Advanced Intrusion Detection Environment).  The exact same product.  Establish your databases of what "files" you want monitored, then compare from that base.  It works like a champ and will email you after it runs as a cron "assuming you set it up that way" and will notify you of any system file changes.  

It is great for someone who has a lot of time to monitor a few systems.  If you are worried about changes on your production systems, you could implement something like puppet. It will ensure files/settings that you define stay the way they are supposed to.  Personally, I hate puppet for my environment (development), but AIDE is tremendous.

Paul

On Aug 30, 2012, at 8:25 PM, Phil Savoie <psavoie1783 at rogers.com> wrote:

> Hi All,
> 
> I am interested in finding out if there is a "history" of filesystem changes that is tracked on a RH system.  Basically, I want to find out who or what did something to a file to change it in any way, shape or form.
> 
> Example I have filex.  filex has a certain content now.  Now+5 file has been changed.  Is there a util to detect this change, i.e., who or what changed it?
> 
> Thanks in advance,
> 
> Phil
> 
> -- 
> redhat-list mailing list
> unsubscribe mailto:redhat-list-request at redhat.com?subject=unsubscribe
> https://www.redhat.com/mailman/listinfo/redhat-list