If Bob tries to access something like /home/Code/TopSecret for example. The system wouldn't allow him to access this without having the permission. I would like to know about these attempts.

Is there a way I can monitor and view these attempts by either modifying auditctl? Or, if it is already being monitored, where would I view these attempts?

Thank you in advance.


You could try to parse ~/.bash_history for every user: grep -e "$pattern" /home/*/.bash_history

To view their sudo commands: tail /var/log/secure | grep username or tail /var/log/secure | grep "$pattern"

As you figured you can track acces to a path with auditctl. Tried on one of my test systems and this works pretty well and its directlty from the man page:

auditctl -w "$path" -a exit,always -S open -F success=0

Again you should parse the audit.log with grep "$pathoffileorfolder" /var/log/audit/audit.log

Thats about what i would use without installing anything that doesnt come with the distro.

  • +1 for auditctl example. -1 for grepping ~/.bash_history which is too easy for a user to circumvent. man ausearch and man aureport for ways to review audit logs as opposed to grep <pattern> audit.log. – MikeA Nov 1 '16 at 16:48

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.