I'm looking for a monitoring service which look for suspicious writing on disk.

Let's say that I have a PHP/Ruby/Python website running on my server, and there is a vulnerability on my website. An attacker can upload/modify any file owned by the apache/nginx user.

Is there any service that can say : "Hey a modification has been made on index.php. It's weird because this file was never modified since its creation."

Or "Hey, there is a new file at /img/reverse.php what is a .php file is doing on /img".

  • You can do this with auditd, inotify, and so on -- but Linux doesn't know your invariants for what's "weird". You need to specify that.
    – Chris Down
    Commented Oct 7, 2017 at 22:51
  • There is no algorithm which would identify suspicious activity, and it would require a lot of effort to write heuristics / machine learning model for that. The problem you mention are solved through more precise access control.
    – myaut
    Commented Oct 7, 2017 at 23:02

1 Answer 1


Set up a regular backup scheme to another machine over the network via ssh using rsync to replicate the file tree(s) of interest. Run it with a listing of changes. Keep that listing in a dated filename on the target machine. The first time would list all the files. Scan the listings after that for what has changed. Then you can review these listings regularly or write an AI program to automate it.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .