I would like to audit writes to a specific file (like /home/john/file.txt) and/or a specific device (like /dev/tty/1). How to do it? By audit I mean:

What was written by process?

Solution based on System Tap are welcome.

  • What about audit subsystem? – Romeo Ninov Feb 10 at 16:06

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.