Set up file change notifications?

Question

System administration

There is a VPS (Centos 6.0, cPanel / WHM - if important) - we have a dozen sites, I want to set up notification when any files in the specified list of directories change.

I can do this using a programming approach - drive everything into git and then send the output of git status via cron if it is not standard.
I would like to see changes often - every 5-15 minutes to see.

What would be the correct approach? Because git is still not fast, on the right volumes ...

There are not many files - 10k, 250 megabytes approximately. It will be, well, a maximum of three times more.

Answer 1

I think one word will suffice: incron .

Answer 2

It's also worth taking a look at auditd.

Answer 3

#!/bin/bash
for f in $(find $searchdir1 ... $searchdirN -cmin $nMin);do someCommand $f;done;

And of course we run all this with cron every $nMin minutes

Answer 4

I think in order to solve the problem correctly, you need to understand what changes you want to know about: “website users replaced the file in the uploads catalog” or “evil hackers hacked into the system and cleaned up the traces”?
Decisions will naturally be different.

Answer 5

“What to do next - and so it’s clear” - it’s not very good for me ... :)
Here, using the example of my warning - that they say /sbin/ifdown and /sbin/ifup have been replaced with scripts. Well, I looked at these scripts - they are quite valid - there is an assumption that this was originally the case when installing the system (or after installing cPanel / WHM). Again, “replace with original ones” - for the system administrator, this seems to be a trivial task, but it’s not obvious to me. Or is there an easy way? yum install ifup doesn't work :) Or how can I see what ifup should be for kernel-2.6.32-71.el6.i686?
But this is so, for the sake of conversation ...
Integrity control - yes, I'm sitting studying Tripwire, incron - in general, what you need. Write prohibition is difficult here, some scripts still write - but in general the idea is clear, it is also likely that you need to prohibit writing from the web server (although how to do this specifically for a certain type of file is not yet clear without putting down the rights to the files you need)