monitor(audit) and log changes inside directory


 
Thread Tools Search this Thread
Top Forums Shell Programming and Scripting monitor(audit) and log changes inside directory
# 1  
Old 02-11-2012
Wrench monitor(audit) and log changes inside directory

Hi, everyone
I would like to write ksh script in ksh (HP-UX), to audit any changes inside target directories.
My enviroment has many constrains, so I can only use ksh and cannot install
any 3rd party soft or command (include perl or other languages)

The script functions like below
1) take a snapshot of the target directory (recursive with the directory inside, like ls -ailR target_dir)
2) log any changes(compare with snapshot) that been added, deleted or modified(include chmod) and seperatly store into log.add, log.del, log.mod
3) this script will excute in crontab once a day

note: maybe could use the cmd "dircmp" to compare two directories, but it's hard to make the snapshot if the directory size is huge

I've already search the related articles both in forum and google.
I do find something ... but due to the constrains of my enviroment,
it's far from complete the goal to finish the script (new to ksh, used to coding in perl)

There's an article https://www.unix.com/shell-programmin...-if-found.html
is closely to my requirement but still long way to go, hope someone can help to complete this script
I'll be very appreciate the effert you've done.

Thanks in advanced.

Stev.H


Thanks to the original author Steven Koh(id : izy100)
I've modified the code as follow
Code:
#!/usr/local/bin/ksh93
#
# UNIX Monitor Script
# Purpose: Monitors the changes in a directory
# Outputs: Log file
# Author : Steven Koh
# Modified by Stev.H
#*********************************************************
#

if test $# -lt 1; then
echo "Usage: $0 <DIR TO MONITOR FOR NEW FILES>"
echo "Example: $0 /var/tmp"
echo
exit 0;
fi

MONITOR_DIR=$1
LOG_DIR="log"
NEW_LOG="${LOG_DIR}/mon_file.log"
OLD_LOG="${LOG_DIR}/mon_file.old"
ADD_FILE="${LOG_DIR}/mon_file.add"
DEL_FILE="${LOG_DIR}/mon_file.del"


if test ${MONITOR_DIR}="./"; then
MONITOR_DIR=`pwd`
fi

if [[ -d $LOG_DIR ]]; then
#if directory log exist then print nothing
print
else
mkdir ${LOG_DIR}
fi

touch ${NEW_LOG}
mv ${NEW_LOG} ${OLD_LOG}

print "============= `date` =============\n${MONITOR_DIR}:" | tee $NEW_LOG
unalias ls
ls -ailR ${MONITOR_DIR} | tee -a ${NEW_LOG}
#egrep -vf ${OLD_LOG} ${NEW_LOG} | grep -v "=============" > ${DIFF_FILE} 2>&1
comm -23 ${OLD_LOG} ${NEW_LOG} | grep -v "=============" > ${DEL_FILE} 2>&1
comm -13 ${OLD_LOG} ${NEW_LOG} | grep -v "=============" > ${ADD_FILE} 2>&1

if test `wc -l < ${DEL_FILE}` -gt 0; then
echo "Monitor files been deleted in ${MONITOR_DIR}"
echo "=================================="
echo
cat ${DEL_FILE}
elif test `wc -l < ${ADD_FILE}` -gt 0; then
echo "Monitor files been added in ${MONITOR_DIR}"
echo "=================================="
echo
cat ${ADD_FILE}
fi


Last edited by stev.h; 02-11-2012 at 02:47 PM..
# 2  
Old 02-12-2012
There are some programs exactly the function I need, like open source EICS - Easy Integrity Check System (sry, cannot post link, plz google it)

or L5 => fossies.org/unix/misc/old/L5.tgz, and commercial soft tripwire

Unfortunately, I cannot find the same wrote in script (still researching

Hope anyone could give a hint, thanks.

Last edited by stev.h; 02-12-2012 at 01:27 PM..
Login or Register to Ask a Question

Previous Thread | Next Thread

10 More Discussions You Might Find Interesting

1. Shell Programming and Scripting

How to grep all the files inside the directory and Sub directory

Hi, I have used the command cat * | grep -r <<String>> * It returns: cat : JAN : is directory *********************** ********************* My directory structure: log - JAN -catalina.out -FEB -catalina.out -MARCH ... (11 Replies)
Discussion started by: nanthagopal
11 Replies

2. AIX

When AIX audit start, How to set the /audit/stream.out file size ?

Dear All When I start the AIX(6100-06)audit subsystem. the log will save in /audit/stream.out (or /audit/trail), but in default when /audit/stream.out to grow up to 150MB. It will replace the original /audit/stream.out (or /audit/trail). Then the /audit/stream.out become empty and... (2 Replies)
Discussion started by: nnnnnnine
2 Replies

3. Shell Programming and Scripting

How to monitor a command inside shell script

Hi All, Is there any way to monitor a command inside shell script ? I have a script inside which I have a tar command which zips around 200GB data. tar zcvf $Bckp_Dir/$Box-BaseBackup-$Day.tar.gz * --exclude 'dbserver_logs/*' --exclude postmaster.pid --exclude 'pg_xlog/*' I want to... (3 Replies)
Discussion started by: sussus2326
3 Replies

4. UNIX for Dummies Questions & Answers

Zip files inside the directory, but not the directory itself

Hi, Im facing a problem that im stucked, I have the following structure: thales@pereirtc-vbox:/home/VfARM$ ls code config doc lib manifest.bak manifest.rel manifest.v3 ns pub if i try to execute zip -q -o arm.zip VfARM/* it will create a zip file with the folder VfARM.... (2 Replies)
Discussion started by: Thales.Claro
2 Replies

5. Shell Programming and Scripting

Directory Monitor in KSh

Hi, I need to write a directory monitor, i.e. a korn shell script which would Report changes to the directory contents, like: added file1, deleted file2, updated file3 , created subdir (optional)... There is no specific file pattern. So far I have written a little script... (1 Reply)
Discussion started by: olegkon
1 Replies

6. UNIX for Dummies Questions & Answers

Monitor directory and email

Hello all, Can anyone please guide / help me in the following task.... I have a directory where some external users will upload pdf files. The filename of these pdf will be of a particular format (<id>-<first name>_<last name>_<some number>.pdf) I want to make a script such that it takes... (6 Replies)
Discussion started by: dhawalkv
6 Replies

7. AIX

monitor directory events

I'm am looking for a cheap way to trigger a script when a new file is written in a specific directory. AIX 5.3. It is a production system, so no kernel patching (i.e. inotify). Filemon and audtiing are too expensive. Thanks in advance. (2 Replies)
Discussion started by: pbillast
2 Replies

8. Shell Programming and Scripting

script to monitor directory

What is the best way for a script to run to monitor a directory for the presence of files and then perform a function afterwords? I was hoping to have it continually run and sleep until it detects that files are present in the directory, then break out of the loop and go on to the next step. ... (17 Replies)
Discussion started by: nulinux
17 Replies

9. Shell Programming and Scripting

Directory inside directory problem

hii, I have to create a directory under the same directory with the date +%a extension like this BackupLocation=$BackupLocation/$BackupLocation$(date +%w) but the problem is --- if backuplocation is abc/dfg then accroding to the above statement it would be abc/dfg/abc/dfg5 but i... (6 Replies)
Discussion started by: namishtiwari
6 Replies

10. UNIX for Dummies Questions & Answers

Directory list inside a directory

Hi Bosses! I have a directory name sih. that directory contains some more directories and some files. i just want to list (ls) the directories under this directory. What will be the command.I am using debian linux. Thanks bosses.will appreciate your help. sih (6 Replies)
Discussion started by: little_jhon
6 Replies
Login or Register to Ask a Question