The title summarises it all but here's an example:
You're sharing some hardware equipment with your dev colleagues, some days everything works well with it, the next day, nothing works anymore, can't even get
yumto play nice, etc. And it's not clear as to what changed since last time.
What I'm looking for is a software, or Linux framework that does system-wide auditing in order to:
- who was logged in and when
- which files have been modified during that session
- what exactly as changed within those files, like
So far, I've seen packages like
acct address the first 2 points but don't seem to provide any detailed info about what has changed, the third point.
As you don't want to necessarily monitor the whole filesystem, restricting to the configuration dir
/etc would be a great start ; keeping track of changes a bit like
diff does. This way it would be easy to find out what config change causes system wide issues. Any ideas?