I have configured auditd to track some sensitive files on my system. Now I would to have a script that will be called each time auditd writes a line, with the $1 argument of that script being the line added.

From what I read in the manual auditd has no such option.

Is there a way to do this anyway?

If I'll have a cron script running every minute, I will have a problem defining it on which lines it should work (which lines are new? if any?)


Using the tail command like so:

tail -Fn0 /var/log/audit/audit.log | /sbin/script

and /sbin/script is like so:

while IFS= read -r line; do
  #something to do with $line variable when it comes
  • 1
    you may wish to tail -F instead of -f so that this still works when the log file is rotated. – Andrew Apr 3 '17 at 1:19

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.