Take the 2-minute tour ×
Unix & Linux Stack Exchange is a question and answer site for users of Linux, FreeBSD and other Un*x-like operating systems.. It's 100% free, no registration required.

I'm currently in choosing of HIDS ( Host-based intrusion detection system ).

I'm discovery etckeeper on my ubuntu.

My question is:

Which of HIDS can trace each file on the filesystem? E.g. keep some database of all files on every partition /dev/sda1 (root), etc... with:

  1. file path from root

  2. modify timestamp

  3. file size

  4. crc32

  5. md5sum

  6. sha256sum

If file was deleted, keep record until defined period is end. e.g. 30 days.

Pretty web interface like e.g. gitweb.

And monitor disk in background with super low priority, but forever. e.g.

$ iostat -x -d sda sdb 1
Device:         rrqm/s   wrqm/s     r/s     w/s    rkB/s    wkB/s avgrq-sz avgqu-sz   await r_await w_await  svctm  %util
sda               4.54    69.66   28.62   57.08   408.09  1105.88    35.33     5.33   62.24   27.50   79.66   3.07  26.34
sdb               2.56     3.01  120.08    9.62  8776.63  1711.23   161.73     5.21   40.16   32.23  139.01   3.63  47.14

Show %util - 26.34% and 47.14% for sda and sdb. Until disk util more than defined user limit, e.g. 10%, Host-IDS will sleep. To prevent what tiger and tripwire does with disk load average.

My request is about not a system files integrity checking, but all of files. Every todays HIDS looks only to specific part of filesystem, /bin/ /sbin/ /usr/bin/. It doesn't look at temporary directory, doesn't try to trace user's home directory.

But it is easy to develop Host-IDS, that would monitor every bit on the disk, silently from user, in deep background. Is there something already?

share|improve this question

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Browse other questions tagged or ask your own question.