0

I'd like to monitor calls to stat on any file within a directory. I know inotifywait can listen for file creation etc. but I don't know anything that can listen for stat. This is on Amazon Linux 2. Any ideas?

0

1 Answer 1

Reset to default
1

auditd can do that.

man auditd.rules -> System Call

Example: https://access.redhat.com/solutions/36278

Also consider its alternatives: https://github.com/slackhq/go-audit https://osquery.io/

2
  • I can't figure out how to restrict this to a specific directory. Closest I got is auditctl -a always,exit -F arch=b64 -S stat -F dir=/tmp/ooo -k mytest but that doesn't show any logs. I also tried -w /tmp/ooo but that doesn't list stat calls.
    – Johnny
    Sep 12, 2021 at 14:01
  • You could offer a bounty for the question. I'm not well versed in the topic and it's far behind, so unlikely to be answered.
    – Artem S. Tashkinov
    Sep 12, 2021 at 14:04

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .