Re: Auditing File Changes
On Mon, 10 Jul 2006 10:29:38 PDT, eklinger(a)uci.edu said:
Good morning. Please forgive me if this has been asked, but will the
file
watch functionality be able to intercept writes and/or be able to
intercept the actual changes to the file and report those, in addition to
the fact that the file was modified?
No. In particular, logging the actual changes is out of the question,
because of the volume-of-data issue. Even logging the fact that writes
occurred is painful - that's why the filter usually used is "file being
opened with write permission" and make the assumption that if it opened
it for write, it will/did actually write to it....
Attachments:
- attachment.sig (application/pgp-signature — 226 bytes)