I'm currently in choosing of HIDS ( Host-based intrusion detection system ).
I'm discovery etckeeper on my ubuntu.
My question is:
Which of HIDS can trace each file on the filesystem? E.g. keep some database of all files on every partition /dev/sda1 (root), etc... with:
file path from root
If file was deleted, keep record until defined period is end. e.g. 30 days.
Pretty web interface like e.g. gitweb.
And monitor disk in background with super low priority, but forever. e.g.
$ iostat -x -d sda sdb 1 Device: rrqm/s wrqm/s r/s w/s rkB/s wkB/s avgrq-sz avgqu-sz await r_await w_await svctm %util sda 4.54 69.66 28.62 57.08 408.09 1105.88 35.33 5.33 62.24 27.50 79.66 3.07 26.34 sdb 2.56 3.01 120.08 9.62 8776.63 1711.23 161.73 5.21 40.16 32.23 139.01 3.63 47.14
Show %util - 26.34% and 47.14% for sda and sdb. Until disk util more than defined user limit, e.g. 10%, Host-IDS will sleep. To prevent what tiger and tripwire does with disk load average.
My request is about not a system files integrity checking, but all of files. Every todays HIDS looks only to specific part of filesystem, /bin/ /sbin/ /usr/bin/. It doesn't look at temporary directory, doesn't try to trace user's home directory.
But it is easy to develop Host-IDS, that would monitor every bit on the disk, silently from user, in deep background. Is there something already?