3

I have configured auditd to track some sensitive files on my system. Now I would to have a script that will be called each time auditd writes a line, with the $1 argument of that script being the line added.

From what I read in the manual auditd has no such option.

Is there a way to do this anyway?

If I'll have a cron script running every minute, I will have a problem defining it on which lines it should work (which lines are new? if any?)

1 Answer 1

Reset to default
2

Using the tail command like so:

tail -Fn0 /var/log/audit/audit.log | /sbin/script

and /sbin/script is like so:

while IFS= read -r line; do
  #something to do with $line variable when it comes
done
1
  • 1
    you may wish to tail -F instead of -f so that this still works when the log file is rotated.
    – Andrew
    Apr 3, 2017 at 1:19

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .