Util that tracks past changes to et4 filesystem?

[Phil Savoie]

On 08/30/2012 09:39 PM, Harry Hoffman wrote:
> So, I know that the Enterprise version of Tripwire will tell you both
> the who and the what.
>
> If you're looking to do it on the cheap then there are a few options.
>
> FUNC: https://fedorahosted.org/func/
> and specifically func-inventory
> https://fedorahosted.org/func/wiki/FuncInventory
>
> This will allow you to track files via git (a versioning app) so you can
> see what changed and when.
>
> For the who, you'd want auditd
>
> Cheers,
> Harry

Thank you Harry!!

Phil



>
> On 08/30/2012 09:23 PM, Phil Savoie wrote:
>> On 08/30/2012 08:49 PM, Harry Hoffman wrote:
>>> Hi Phil,
>>>
>>> You're looking for Tripwire or one of it's open source (aide, I think)
>>> variants.
>>>
>>> It will take a hash of the file to compare later, you can also do file
>>> versioning.
>>>
>>> Cheers,
>>> Harry
>>
>> Thanks Harry,
>>
>> But will this tell me whoor what made the change?
>>
>> Thanks,
>>
>> Phil
>>
>>
>>
>>
>>>
>>> On 08/30/2012 08:25 PM, Phil Savoie wrote:
>>>> Hi All,
>>>>
>>>> I am interested in finding out if there is a "history" of filesystem
>>>> changes that is tracked on a RH system.  Basically, I want to find out
>>>> who or what did something to a file to change it in any way, shape or
>>>> form.
>>>>
>>>> Example I have filex.  filex has a certain content now.  Now+5 file has
>>>> been changed.  Is there a util to detect this change, i.e., who or what
>>>> changed it?
>>>>
>>>> Thanks in advance,
>>>>
>>>> Phil
>>>>
>>>
>>
>

-- 
Carpe Aptenodytes! (Seize the Penguins!)