Home / server / Questions / 997392
Accepted
Ex Umbris
Asked: 2020-01-03 10:22:41 +0800 CST

Logging changes to file change/modify attributes

  • 772

System is Centos8

I need to determine what process is touching a file without making any changes in content. I've tried auditctl but it does not seem to have a filesystem watch that can track these attributes.

sudo auditctl -w /boot/grub2/grubenv -p a -k GRUBENV

but this does not capture timestamp changes.

Is there a way to log changes to file modify/change timestamps that do not alter anything else about the file?

auditd

1 Answers

  1. Best Answer

    Timestamp change is more like write operation. So the command should look like:

    sudo auditctl -w /boot/grub2/grubenv -p wa -k GRUBENV
    • 1