Re: How to catch process that removes files?
WireSpot wrote:
> Can anyone recommend a piece of software that will watch a file or a
> directory and tell me what processes mess with the files in there? In
> particular, I'd like it to react when a file is removed.
Tripwire can tell you that it's changed, but not who has changed it.
There's a debian package by the same name for the free version (retired
product got GPL'd), though the change management features and auditing
support are way better if you're in a business environment with a budget to
go in on Tripwire Enterprise.
> I tried dnotify but it only tells me that it happened, after it
> happened, not who did it.
I know there's some kind of auditing option that you have to enable at the
kernel level to be able to pass that kind of auditing information to
programs like dnotify and tripwire, but they escape me right now.
> I need this because on this one Debian testing server I have a problem
> that's driving me mad: something comes around and periodically removes
> files from /var dirs, making certain services crash and burn: Samba
> tdb files, Apache SSL mutex, MySQL and Postgres runtime files and so
> on. And I can't figure out who the hell is doing that.
Is tmpreaper installed, but misconfigured?
Reply to: