I am a company owner and we use DO… I just need to learn how to review what was deposited on a Day to Day basis
Happy to pay someone.....
These answers are provided by our Community. If you find them useful, show some love by clicking the heart. If you run into issues leave a comment, or add your own answer to help others.
×Add this to a file, make it executable, then set up a cron for a daily run:
Question
#!/bin/bash
date=$(date)
echo "##################################################" >> /var/log/file_change.log
echo $date >> /var/log/file_change.log
echo "##################################################" >> /var/log/file_change.log
find / -mtime -1 >> /var/log/file_change.log
Adding to cron:
crontab -e
add this line (replacing the file path to the actual path/name)
00 02 * * * /root/file_integrity_monitor.sh
Making exeutable (change path and file name, of course):
chmod +x /root/file_integrity_monitor.sh
Really appreciate your reply Jons
What will this do? Please know I am not that technical..
Sorry for the delay. It will create a log file that looks something like this:
##################################################
Mon Jun 27 17:38:55 UTC 2015
##################################################
/etc/httpd/logs/httpd.log
/var/log/some_file.log
/var/log/mail.log
/var/log/err.log
##################################################
Mon Jun 28 17:38:55 UTC 2015
##################################################
/etc/httpd/logs/httpd.log
/var/log/some_file.log
/var/log/mail.log
/var/log/err.log
##################################################
Mon Jun 29 17:38:55 UTC 2015
##################################################
/etc/httpd/logs/httpd.log
/etc/passwd
/var/log/some_file.log
/var/log/mail.log
/var/log/err.log
Now, in the example above, if you were to see the change in the last set of messages (/etc/passwd), it would be time to start worrying.
If it’s log files, that’s to be expected. Other files are on a case-by-case basis.