Top Nav

Monitor Web Site Files With Auditd

The Linux Auditing System and auditd are a great way to monitor who and when changes are made to the files in your website.  To install and configure follow these steps:

1. Install auditd and related utilities:

2. Make sure auditd is running:

3. Edit /etc/audit/auditd.conf and change:

This sets any action emails to go to your preferred address.

4. Edit /etc/audit/audit.rules and add a line like this to the bottom:

So if you website is located at:

Then a command like:

would setup auditing of write and attribute change requests. Events matching this rule would be tagged with the “mysite” key.

Audit logs go to: