I need to be able to watch directories on our servers, and track changes to files as part of our audit compliance. I have adjusted auditd to watch the directories, and send all writes and attribute changes to syslog (which immediately forwards on to my splunk server)

this is helpful, it shows who changed a file, but does not actually show you what was changed. If I do a "vi app.conf" and make a change, it will just show that I wrote the file.

I have looked briefly at both AIDE and etckeeper, but I need to track about 2 dozen servers, and that seems rather manual.

For my networking equipment, Rancid has been awesome, with its automatic emails of Diff's. (its actually saved our bacon more than once too)

Is there such a thing as a rancid like tool for linux to monitor directories remotely?

  • 1
    Why not push config files through puppet, which reads the files to be pushed from a git repository? blog.wikimedia.org/2011/09/19/… – Jeff Ferland Apr 5 '13 at 0:02
  • The applications need to be restarted to re-read new configs, and we have a hierarchy of applications that process information over multiple machines. there is a very, very specific process that has to happen across multiple computers to restart the applications in a way that has no downtime. – Brian Apr 5 '13 at 16:11
  • there is also one executable, that is launched multiple times with different config files to bind to different ports, settings, etc. So determining which one to even send a "reload" command to would be difficult. Older programs. – Brian Apr 5 '13 at 16:13

As you're using Splunk, check out FSChange. It's been deprecated in Splunk 5 (though it's still there), but it might do what you want.

An alternative to FSChange might be something like Samhain's file integrity monitoring, coupled with Splunk.


As far as I know auditd can't be configured to capture the file content. You probably wouldn't want it to anyway due to performance hit. So you need to create a baseline to which to compare the changed and original content.

If what you are auditing is a very small set of data you can simply use a frequent backup (or snapshotted filesystem on SAN or something) as your baseline version and do manual diffs. It seems, however, that you are trying to avoid manual solutions.

What it seems you are looking for is File Integrity Monitoring, just as @Michael mentions. These basically run a baseline scan and monitor for (a configurable set of) changes to a defined set of data. I say configurable, because you can include or exclude the file's content from the scan; it's all policy based. As the name implies, the purpose is to monitor the integrity of a system, not necessarily data content. So you will generally monitor application config files and compiled code, critical OS files, etc. to ensure that the system hasn't been compromised. These can also be used for network devices and databases and popular applications. Network devices are easy because the entire config is in a single file (or small footprint anyway).

We use Tripwire in my shop, where we have a great deal of compliance to deal with, but there are others: http://en.wikipedia.org/wiki/File_integrity_monitoring

FIM solutions will generally send alerts and reports to help automate the monitoring part. They will also have compatibility or partnerships with other solutions to integrate with SIEM solutions, even Splunk!. If you have a lot of monitoring to do then you'll spend all of your time reviewing logs. So, basically, "security is hard" ;-) These things are scalable and multiplatform and come in agent and agentless forms. You probably aren't the only one with such needs in your org. Any expense (and it might be less than you would think) can likely be shared to secure more than just your application.


Have you considered TripWire?


OpenSource version: http://sourceforge.net/projects/tripwire/

Sounds like it might be able to do what you are wanting, but I have only used it for basic alerts like "alert if anything changes."

Not the answer you're looking for? Browse other questions tagged or ask your own question.