Member Avatar for Duki

Hey everyone,

We need to monitor who changes what files/folders and when they do that. Is there software that we can get to do this?

  • 4 Contributors
  • 3 Replies
  • 115 Views
  • 2 Years Discussion Span
  • Latest Post Latest Post by rubberman

Dani AI

Generated

For quick orientation: capturing "what/when" is easy; capturing "who" needs OS-level auditing, not just a change scanner. As asked, the practical route is to enable host auditing and then connect those audit events to a log/alerting pipeline. That answers : file-integrity scanners tell you a file changed and when, but the OS audit subsystem is what records the account (and process) that made the change. was right that there are kernel event APIs, but for attribution you want the audit framework rather than a lightweight watcher.

Linux (recommended starter)
Install and run the audit daemon and add targeted rules rather than auditing everything. Example test commands:

auditctl -w /path/to/watch -p wa -k watch_key
ausearch -k watch_key

Make rules persistent in /etc/audit/rules.d. Audit records include fields like auid, uid, pid and exe so you can see the originating login, the process, and the account. Fanotify can provide PID-level real-time inspection, but auditd is the standard for forensic attribution.

Windows (recommended starter)
Enable object-access auditing via Group Policy (Advanced Audit Policy -> Object Access -> Audit File System) or Local Security Policy, then add SACLs on the files/folders (Properties -> Security -> Advanced -> Auditing). Security events for object access contain account name/SID and often the calling process; adding Sysmon gives richer process correlation. For file shares, enable auditing on the file server (server-side auditing).

Practical tips
Start small—audit one directory, perform a controlled change, and verify logs. Forward audit logs to a central collector/SIEM, protect and retain them, and ensure NTP time sync. Tune rules to avoid excessive volume. Combine FIM tools (Tripwire/AIDE/OSSEC/Wazuh) for detection with audit logs for attribution and use them together for alerts and investigations.

Recommended Answers

All 3 Replies

Member Avatar for Doctor Inferno

Check this link out:

Member Avatar for EmmaL

As far as am concerned, monitoring software can only monitor what files/folders are changed and when they are changed but can not monitor who changed them.

Member Avatar for rubberman

Depends upon the OS. For Linux there is the inotify event subsystem. Don't know/care what Windoze uses.

Be a part of the DaniWeb community

We're a friendly, industry-focused community of developers, IT pros, digital marketers, and technology enthusiasts meeting, networking, learning, and sharing knowledge.