Need Help from a savvy Digital Oceaner
I am a company owner and we use DO... I just need to learn how to review what was deposited on a Day to Day basis
Happy to pay someone.....
Log In to Comment
4 Answers
Add this to a file, make it executable, then set up a cron for a daily run:
#!/bin/bash
date=$(date)
echo "##################################################" >> /var/log/file_change.log
echo $date >> /var/log/file_change.log
echo "##################################################" >> /var/log/file_change.log
find / -mtime -1 >> /var/log/file_change.log
Adding to cron:
crontab -e
add this line (replacing the file path to the actual path/name)
00 02 * * * /root/file_integrity_monitor.sh
Making exeutable (change path and file name, of course):
chmod +x /root/file_integrity_monitor.sh
-
Sorry for the delay. It will create a log file that looks something like this:
################################################## Mon Jun 27 17:38:55 UTC 2015 ################################################## /etc/httpd/logs/httpd.log /var/log/some_file.log /var/log/mail.log /var/log/err.log ################################################## Mon Jun 28 17:38:55 UTC 2015 ################################################## /etc/httpd/logs/httpd.log /var/log/some_file.log /var/log/mail.log /var/log/err.log ################################################## Mon Jun 29 17:38:55 UTC 2015 ################################################## /etc/httpd/logs/httpd.log /etc/passwd /var/log/some_file.log /var/log/mail.log /var/log/err.logNow, in the example above, if you were to see the change in the last set of messages (/etc/passwd), it would be time to start worrying.
If it's log files, that's to be expected. Other files are on a case-by-case basis.
Have another answer? Share your knowledge.