Okay, let's start with something simple and work our way up to something awesome. First, let's check to see whether any audit rules are in effect:
[donnie@localhost ~]$ sudo auditctl -l [sudo] password for donnie: No rules [donnie@localhost ~]$
As you can see, the auditctl command is what we use to manage audit rules. The -l option lists the rules.
Now, let's say that we want to see when someone changes the /etc/passwd file. (The command that we'll use will look a bit daunting, but I promise that it will make sense once we break it down.) Look at the following code:
[donnie@localhost ~]$ sudo auditctl -w /etc/passwd -p wa -k passwd_changes [sudo] password for donnie: [donnie@localhost ~]$ sudo auditctl -l -w /etc/passwd -p wa -k passwd_changes [donnie@localhost ~]$
Here's the breakdown:
-w: This stands for where, and it points to the object that we want to monitor. In this case, it's/etc/passwd.-p: This indicates the object's permissions that...