I know about inotify but am concerned it would use too many resources.

Is there a better way to monitor a fairly static system (like a web host) for new and unexpected files being created?

  • I suggest looking into fanotify, it does a lot of the same things that inotify can, but solves most of the resource related issues. – Austin Hemmelgarn Nov 28 '18 at 19:35

Inotify monitors directories individually. To monitor a directory tree, you need to monitor each subdirectory, and to attach to new subdirectories when they are added. I'm note sure if it's possible to do this without a race condition.

If you want to log the files that are created in a directory, there are better ways. You can put the files to watch on a loggedfs filesystem, which implements the logging in userland. Alternatively, you can use the kernel audit facility. See https://unix.stackexchange.com/questions/6068/is-it-possible-to-find-out-what-program-or-script-created-a-given-file/6080#6080 for more technical information.

I don't have practical experience with either method in production, but I doubt that RAM consumption would be significant either way. There's a larger overhead with the loggedfs method which might be significant for files that are read very often but modified only occasionally, because you'll pay the overhead for all accesses, not just writes. Additionally the loggedfs method makes a shadow view of the files, and if you're worried about malware, it might bypass the shadow view and access the original, unmonitored view directly. So for your use case audit is more appropriate.

The rule is something like (untested)

auditctl -a exit,always -F path=/var/www -p w

This gives you real-time logging, which may or may not be useful. I suspect that the detailed information would be useful for forensics, but not so much for alerts, because you'd have too much detail to sift through, but that really depends on the patterns of changes. There are programs that list files on demand and report changes since the last run, for example AIDE and Tripwire. They fit in th general class of intrusion detection systems, and more advanced software definitely exists, but this isn't a topic that I'm familiar with.

  • Another alternative would be to use the newer and more robust fanotify interface provided by the kernel. – Austin Hemmelgarn Nov 28 '18 at 19:34

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.