So, I know that the Enterprise version of Tripwire will tell you both the who and the what. If you're looking to do it on the cheap then there are a few options. FUNC: https://fedorahosted.org/func/ and specifically func-inventory https://fedorahosted.org/func/wiki/FuncInventory This will allow you to track files via git (a versioning app) so you can see what changed and when. For the who, you'd want auditd Cheers, Harry On 08/30/2012 09:23 PM, Phil Savoie wrote: > On 08/30/2012 08:49 PM, Harry Hoffman wrote: >> Hi Phil, >> >> You're looking for Tripwire or one of it's open source (aide, I think) >> variants. >> >> It will take a hash of the file to compare later, you can also do file >> versioning. >> >> Cheers, >> Harry > > Thanks Harry, > > But will this tell me whoor what made the change? > > Thanks, > > Phil > > > > >> >> On 08/30/2012 08:25 PM, Phil Savoie wrote: >>> Hi All, >>> >>> I am interested in finding out if there is a "history" of filesystem >>> changes that is tracked on a RH system. Basically, I want to find out >>> who or what did something to a file to change it in any way, shape or >>> form. >>> >>> Example I have filex. filex has a certain content now. Now+5 file has >>> been changed. Is there a util to detect this change, i.e., who or what >>> changed it? >>> >>> Thanks in advance, >>> >>> Phil >>> >> > -- redhat-list mailing list unsubscribe mailto:redhat-list-request@xxxxxxxxxx?subject=unsubscribe https://www.redhat.com/mailman/listinfo/redhat-list
