0

We have a directory /home/test/abc Sometimes we found that the directory is not present. Most probably it is deleted by someone. We have lots of users who log in and out from the system. I have checked the bash_history of all the users but nobody seems to have executed the rm command. I would like to know if there is a way to monitor this directory and notify if a user or a script is trying to modify this directory. I am using Centos

user3198755
  • 477
  • 2
  • 10
  • 21
  • You could write a wrapper for `rm` or maybe implement the [_sticky bit_](https://en.wikipedia.org/wiki/Sticky_bit) to `/home/test/abc` (`man chmod`). – James Brown May 05 '17 at 06:03

1 Answers1

0

You can do two things:

You can install a utility that called acct (psacct), to monitoring on the user's activity on your machine.

You can install a tool that called inotify-tool, and after that, run the command: sudo inotifywait -m <your_file_path_here>, and it will monitor on your file activity in LIVE.

Mr.Cohen
  • 1
  • 1