{"id":1924,"date":"2016-08-18T21:36:33","date_gmt":"2016-08-19T05:36:33","guid":{"rendered":"http:\/\/systemsolver.com\/StatlerBlog\/?p=1924"},"modified":"2016-08-18T21:36:33","modified_gmt":"2016-08-19T05:36:33","slug":"linux-audit-with-auditd","status":"publish","type":"post","link":"https:\/\/systemsolver.goodhealthyday.com\/StatlerBlog\/2016\/08\/18\/linux-audit-with-auditd\/","title":{"rendered":"linux audit with auditd or audit"},"content":{"rendered":"<p>First section non-systemd linux, second section systemd linux.<\/p>\n<p>For non-systemd linux:<\/p>\n<p><a href=\"http:\/\/www.cyberciti.biz\/tips\/linux-audit-files-to-see-who-made-changes-to-a-file.html\">http:\/\/www.cyberciti.biz\/tips\/linux-audit-files-to-see-who-made-changes-to-a-file.html<\/a><\/p>\n<p><code>install audit<\/code><\/p>\n<p>start on boot<\/p>\n<p><code>ntsysv<br \/>\nor<br \/>\nchkconfig auditd on<\/code><\/p>\n<p><code>\/etc\/init.d\/auditd start<\/code><\/p>\n<p><code>auditctl -w\u00a0\"\/media\/Office-Files\/Files\/a-PI\/Clients\" -p rwxa<\/code><\/p>\n<p><code>ausearch -f\u00a0\"\/media\/Office-Files\/Files\/a-PI\/Clients\" -i | less<\/code><\/p>\n<p>For systemd linux:<\/p>\n<p><a href=\"https:\/\/www.linux.com\/learn\/linux-system-monitoring-and-more-auditd\">https:\/\/www.linux.com\/learn\/linux-system-monitoring-and-more-auditd<\/a><\/p>\n<p><a href=\"https:\/\/www.linux.com\/learn\/customized-file-monitoring-auditd\">https:\/\/www.linux.com\/learn\/customized-file-monitoring-auditd<\/a><\/p>\n<p>With distribution install audit or auditd<\/p>\n<pre>sudo systemctl status auditd.service<\/pre>\n<pre>sudo systemctl start auditd.service<\/pre>\n<pre>sudo systemctl enable auditd.service #to run at boot\n\nsudo aureport<\/pre>\n<p>&nbsp;<\/p>\n","protected":false},"excerpt":{"rendered":"<p>First section non-systemd linux, second section systemd linux. For non-systemd linux: http:\/\/www.cyberciti.biz\/tips\/linux-audit-files-to-see-who-made-changes-to-a-file.html install audit start on boot ntsysv or chkconfig auditd on \/etc\/init.d\/auditd start auditctl -w\u00a0&#8220;\/media\/Office-Files\/Files\/a-PI\/Clients&#8221; -p rwxa ausearch -f\u00a0&#8220;\/media\/Office-Files\/Files\/a-PI\/Clients&#8221; -i | less For systemd linux: https:\/\/www.linux.com\/learn\/linux-system-monitoring-and-more-auditd https:\/\/www.linux.com\/learn\/customized-file-monitoring-auditd With distribution install audit or auditd sudo systemctl status auditd.service sudo systemctl start auditd.service sudo systemctl enable [&hellip;]<\/p>\n","protected":false},"author":1,"featured_media":0,"comment_status":"closed","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[4],"tags":[],"class_list":["post-1924","post","type-post","status-publish","format-standard","hentry","category-general"],"jetpack_featured_media_url":"","_links":{"self":[{"href":"https:\/\/systemsolver.goodhealthyday.com\/StatlerBlog\/wp-json\/wp\/v2\/posts\/1924","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/systemsolver.goodhealthyday.com\/StatlerBlog\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/systemsolver.goodhealthyday.com\/StatlerBlog\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/systemsolver.goodhealthyday.com\/StatlerBlog\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/systemsolver.goodhealthyday.com\/StatlerBlog\/wp-json\/wp\/v2\/comments?post=1924"}],"version-history":[{"count":0,"href":"https:\/\/systemsolver.goodhealthyday.com\/StatlerBlog\/wp-json\/wp\/v2\/posts\/1924\/revisions"}],"wp:attachment":[{"href":"https:\/\/systemsolver.goodhealthyday.com\/StatlerBlog\/wp-json\/wp\/v2\/media?parent=1924"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/systemsolver.goodhealthyday.com\/StatlerBlog\/wp-json\/wp\/v2\/categories?post=1924"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/systemsolver.goodhealthyday.com\/StatlerBlog\/wp-json\/wp\/v2\/tags?post=1924"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}