Re: Configuration file monitoring - reporting content changes

[John Dennis <jdennis@redhat.com>]

On 07/20/2015 07:08 PM, Steve Grubb wrote:
> On Monday, July 20, 2015 09:53:47 PM Burn Alting wrote:
>> I am interested in any Linux based capability that will monitor
>> identified files and report on actual changes to the monitored file.
>
> I know of nothing that does this. But as long as the list of files is limited,
> it doesn't sound like a hard program to write.

> Any one else with an opinion?

Yes :-) I'm not so sure it's an easy program to write and be robust in a 
variety of scenarios. I know because I wrote such a program once. The 
basic problem is most people think in terms of monitoring a file by name 
(e.g. it's pathname). But inotify operates on inodes, not filenames. If 
that file is subject to any variety of log rotation strategies or 
modifications by a configuration manager whereby the file is renamed or 
moved to a different directory then any program using inotify to monitor 
the file needs to become reasonably sophisticated and be able to track 
those changes. It is entirely possible for two processes to have opened 
the same file by name but have them be 2 different files (e.g. after 
opening the file path is modified but the process still has the original 
inode open, now a 2nd process opens the same filename but gets a 
different inode). Conflating inodes with filenames can lead to 
unexpected results and if the purpose is some sort of security 
monitoring it will be important these issues are accounted for.

Some of this is discussed in these documents which accompany the lwatch 
(Log Watch) program I wrote:

https://jdennis.fedorapeople.org/lwatch/html/InotifyOverview.html
https://jdennis.fedorapeople.org/lwatch/html/LogWatchOverview.html


-- 
John