https://community.splunk.com/t5/Getting-Data-In/File-System-Monitoring/m-p/155468#M31576 <P>Hey,</P> <P>I am trying to monitor changes to specific, sensitive folders on my samba file share. Therefore, the fschange feature seemed to be the perfect fit for me, but unfortunately it's not available anymore. Searching for an alternative, I did not really come across a suitable solution for monitoring file system changes on a samba file share.</P> <P>What i want to know:<BR /> - Operation performed (read, write, delete)<BR /> - User<BR /> - Timestamp<BR /> - Optionally: Time a file is accessed<BR /> - Optionally: Restriced file access (users trying to access files/directories they arent permitted to access)</P> <P>That's basically it, does anyone have a suitable solution for this issue?</P> <P>Regards<BR /> Flo</P> Mon, 25 Nov 2013 19:17:04 GMT ESIMatNeforce 2013-11-25T19:17:04Z https://community.splunk.com/t5/Getting-Data-In/File-System-Monitoring/m-p/155468#M31576 <P>Hey,</P> <P>I am trying to monitor changes to specific, sensitive folders on my samba file share. Therefore, the fschange feature seemed to be the perfect fit for me, but unfortunately it's not available anymore. Searching for an alternative, I did not really come across a suitable solution for monitoring file system changes on a samba file share.</P> <P>What i want to know:<BR /> - Operation performed (read, write, delete)<BR /> - User<BR /> - Timestamp<BR /> - Optionally: Time a file is accessed<BR /> - Optionally: Restriced file access (users trying to access files/directories they arent permitted to access)</P> <P>That's basically it, does anyone have a suitable solution for this issue?</P> <P>Regards<BR /> Flo</P> Mon, 25 Nov 2013 19:17:04 GMT https://community.splunk.com/t5/Getting-Data-In/File-System-Monitoring/m-p/155468#M31576 ESIMatNeforce 2013-11-25T19:17:04Z https://community.splunk.com/t5/Getting-Data-In/File-System-Monitoring/m-p/155469#M31577 <P>Perhaps either of these links may provide with guidance for a relevant tool;</P> <P><A href="http://en.wikipedia.org/wiki/Integrity_checker" target="_blank">http://en.wikipedia.org/wiki/Integrity_checker</A><BR /> <A href="http://en.wikipedia.org/wiki/Samhain_%28software%29" target="_blank">http://en.wikipedia.org/wiki/Samhain_(software)</A><BR /> <A href="http://en.wikipedia.org/wiki/Comparison_of_file_verification_software" target="_blank">http://en.wikipedia.org/wiki/Comparison_of_file_verification_software</A><BR /> <A href="http://en.wikipedia.org/wiki/Tripwire_%28software%29" target="_blank">http://en.wikipedia.org/wiki/Tripwire_(software)</A></P> <P>If you also want to record access <EM>attempts</EM>, you may have to look into the audit daemon.</P> <P><A href="http://security.blogoverflow.com/2013/01/a-brief-introduction-to-auditd/" target="_blank">http://security.blogoverflow.com/2013/01/a-brief-introduction-to-auditd/</A><BR /> <A href="http://xmodulo.com/2013/05/how-to-monitor-file-access-on-linux.html" target="_blank">http://xmodulo.com/2013/05/how-to-monitor-file-access-on-linux.html</A></P> <P>/K</P> Mon, 28 Sep 2020 15:21:48 GMT https://community.splunk.com/t5/Getting-Data-In/File-System-Monitoring/m-p/155469#M31577 kristian_kolb 2020-09-28T15:21:48Z