Qusetion on logging file deletions with auditd

Qusetion on logging file deletions with auditd

[Walt Powell]

[-- Attachment #1.1: Type: text/plain, Size: 229 bytes --]

What would the appropriate syscall be in the audit.rules file to log file deletions with auditd?  I'm thinking the syntax would be something akin to -w entry, always -S delete, but that doesn't seem to work...

Thanks to all...

[-- Attachment #1.2: Type: text/html, Size: 646 bytes --]

[-- Attachment #2: Type: text/plain, Size: 0 bytes --]

Re: Qusetion on logging file deletions with auditd

[Steve Grubb]

On Tuesday 30 January 2007 20:49, Walt Powell wrote:
> What would the appropriate syscall be in the audit.rules file to log file
> deletions with auditd?

Assuming current upstream kernel...In terms of watches, I think deletion is 
considered a write. But if you audit writes like this:

auditctl -w /var/log/messages -p w -k delete-logs

you will likely get more than you asked for. So, you could do it this way:

auditctl -a exit,always -S unlink -F path=/var/log/messages -F key=delete-logs

and then find them with:

ausearch --start today -k delete-logs

-Steve