topic Re: fschange deprecated; what options are available in Getting Data In

fschange deprecated; what options are available

joonradley — Thu, 29 Nov 2012 11:56:56 GMT

The 5.0 release documentation states that fschange is deprecated.

We use this extensively for configuration change detection. Does anyone know of how to get the same functionality as fschange on Linux and Windows?

Thx

Re: fschange deprecated; what options are available

Ayn — Thu, 29 Nov 2012 12:08:57 GMT

Do you mean using Splunk exclusively, or do you want to know about other products that could solve this for you?

Re: fschange deprecated; what options are available

kristian_kolb — Thu, 29 Nov 2012 12:19:37 GMT

For Linux, I'd guess that the auditd would be able to solve most things. Configuring it to be less noisy is probably an exercise.

For Windows, I'd guess that you have to enable auditing on "object access", and set ACL's on the objects (files/directories) you wish to monitor. Exactly how to do this is a bit beyond my experience.

Re: fschange deprecated; what options are available

joonradley — Fri, 30 Nov 2012 06:08:03 GMT

Any product will do at the moment.

Re: fschange deprecated; what options are available

joonradley — Fri, 30 Nov 2012 06:08:38 GMT

Can you pull in the entire configuration file with these methods?

Re: fschange deprecated; what options are available

kristian_kolb — Fri, 30 Nov 2012 07:35:20 GMT

Not too sure about that - or rather, I'm quite certain you can't. But what you will get is WHO made the change.

Re: fschange deprecated; what options are available

joonradley — Fri, 30 Nov 2012 10:56:25 GMT

Unfortunately I also need to track the changed contents as well.

Re: fschange deprecated; what options are available

miteshvohra — Thu, 11 Apr 2013 11:00:33 GMT

TripWire does a good job of monitoring changes. Unsure if there is a ready made app for it.

My two cents.