Some files on a Debian 9 server periodically overwritten to the original status after I modified it. I couldn't find what process/program is doing that job. Nothing is defined on crontab. Posibilly from a remote server (i.e. Ansible/Puppet) but I cound't find evidence.

I tried to use lsof and fuser but no process is using these files.

My question is how to setup a monitor to monitor these files and find out what process changed their contents.

  • You may find solutions there: unix.stackexchange.com/questions/92013/… – iaeiou Jan 8 at 8:41
  • 1
    I read that thread before. However, inotify won't tell you which process has modified the file. Strace only tracks a running program which not in my case. – NeilWang Jan 10 at 9:37

Good question! Intrusion Detection Systems are used for things like this or at least they could be so maybe one of those (aide, tripwire, ...) already has such capability or one could ask about it there.

If you know the files being modified beforehand (or a list of files which are important to remain unmodified and the times and usernames that show that you modified them yourself) you could use something suggested here.

If you'd like to use auditd here you can find a guide to do so.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.