From mboxrd@z Thu Jan 1 00:00:00 1970 From: "Walt Powell" Subject: Qusetion on logging file deletions with auditd Date: Tue, 30 Jan 2007 20:49:36 -0500 Message-ID: <000e01c744da$112dec10$6400a8c0@powerbox> Mime-Version: 1.0 Content-Type: multipart/mixed; boundary="===============1217936565==" Return-path: Received: from mx1.redhat.com (mx1.redhat.com [172.16.48.31]) by int-mx1.corp.redhat.com (8.13.1/8.13.1) with ESMTP id l0V1nlnk007748 for ; Tue, 30 Jan 2007 20:49:47 -0500 Received: from ms-smtp-02.ohiordc.rr.com (ms-smtp-02.ohiordc.rr.com [65.24.5.136]) by mx1.redhat.com (8.13.1/8.13.1) with ESMTP id l0V1nh1Y018755 for ; Tue, 30 Jan 2007 20:49:43 -0500 Received: from powerbox (cpe-65-189-170-115.columbus.res.rr.com [65.189.170.115]) by ms-smtp-02.ohiordc.rr.com (8.13.6/8.13.6) with SMTP id l0V1nbGK008759 for ; Tue, 30 Jan 2007 20:49:37 -0500 (EST) List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Sender: linux-audit-bounces@redhat.com Errors-To: linux-audit-bounces@redhat.com To: linux-audit@redhat.com List-Id: linux-audit@redhat.com This is a multi-part message in MIME format. --===============1217936565== Content-Type: multipart/alternative; boundary="----=_NextPart_000_000B_01C744B0.27634AE0" This is a multi-part message in MIME format. ------=_NextPart_000_000B_01C744B0.27634AE0 Content-Type: text/plain; charset="iso-8859-1" Content-Transfer-Encoding: quoted-printable What would the appropriate syscall be in the audit.rules file to log = file deletions with auditd? I'm thinking the syntax would be something = akin to -w entry, always -S delete, but that doesn't seem to work... Thanks to all... ------=_NextPart_000_000B_01C744B0.27634AE0 Content-Type: text/html; charset="iso-8859-1" Content-Transfer-Encoding: quoted-printable

What would the appropriate syscall be = in the=20 audit.rules file to log file deletions with auditd? I'm = thinking the=20 syntax would be something akin to -w entry, always -S delete, but that = doesn't=20 seem to work...

Thanks to = all...

------=_NextPart_000_000B_01C744B0.27634AE0-- --===============1217936565== Content-Type: text/plain; charset="us-ascii" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit Content-Disposition: inline --===============1217936565==-- From mboxrd@z Thu Jan 1 00:00:00 1970 From: Steve Grubb Subject: Re: Qusetion on logging file deletions with auditd Date: Mon, 5 Feb 2007 09:07:41 -0500 Message-ID: <200702050907.41290.sgrubb@redhat.com> References: <000e01c744da$112dec10$6400a8c0@powerbox> Mime-Version: 1.0 Content-Type: text/plain; charset="utf-8" Content-Transfer-Encoding: 7bit Return-path: In-Reply-To: <000e01c744da$112dec10$6400a8c0@powerbox> Content-Disposition: inline List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Sender: linux-audit-bounces@redhat.com Errors-To: linux-audit-bounces@redhat.com To: linux-audit@redhat.com List-Id: linux-audit@redhat.com On Tuesday 30 January 2007 20:49, Walt Powell wrote: > What would the appropriate syscall be in the audit.rules file to log file > deletions with auditd? Assuming current upstream kernel...In terms of watches, I think deletion is considered a write. But if you audit writes like this: auditctl -w /var/log/messages -p w -k delete-logs you will likely get more than you asked for. So, you could do it this way: auditctl -a exit,always -S unlink -F path=/var/log/messages -F key=delete-logs and then find them with: ausearch --start today -k delete-logs -Steve