I have configured auditd to track some sensitive files on my system. Now I would to have a script that will be called each time auditd writes a line, with the
$1 argument of that script being the line added.
From what I read in the manual auditd has no such option.
Is there a way to do this anyway?
If I'll have a cron script running every minute, I will have a problem defining it on which lines it should work (which lines are new? if any?)