Re: Configuration file monitoring - reporting content changes

Burn Alting wrote: > All, > > I am interested in any Linux based capability that will monitor > identified files and report on actual changes to the monitored file. I > know there are methods of recording that the file has been changed (e.g. > aide and/or monitor writes via auditd), but I want to know what has > changed ... basically something that would provide a 'diff' like output. > > Now there are tools like Samhain that will record the content changes of > a file that is <= 92000 bytes in size, but I am interested in a more > lightweight solution ... perhaps a simple inotify(7) based utility that > perhaps maintains a copy of the file(s) in core (in compressed format) > and based on inotify() returns checks for changes and reports (somehow > yet to be defined) the before/after changes. > > Is there anything 'out there' that list members are aware of? If you don't need to protect "copy of the file(s)" from malicious attacks, I think cvs / svn / git etc. would be sufficient. If you need to protect "copy of the file(s)" from malicious attacks, you would need to use access control mechanisms (e.g. SELinux).