File System Monitoring

[ESIMatNeforce]

Hey,

I am trying to monitor changes to specific, sensitive folders on my samba file share. Therefore, the fschange feature seemed to be the perfect fit for me, but unfortunately it's not available anymore. Searching for an alternative, I did not really come across a suitable solution for monitoring file system changes on a samba file share.

What i want to know:
- Operation performed (read, write, delete)
- User
- Timestamp
- Optionally: Time a file is accessed
- Optionally: Restriced file access (users trying to access files/directories they arent permitted to access)

That's basically it, does anyone have a suitable solution for this issue?

Regards
Flo

[kristian_kolb]

Perhaps either of these links may provide with guidance for a relevant tool;

http://en.wikipedia.org/wiki/Integrity_checker
http://en.wikipedia.org/wiki/Samhain_(software)
http://en.wikipedia.org/wiki/Comparison_of_file_verification_software
http://en.wikipedia.org/wiki/Tripwire_(software)

If you also want to record access attempts, you may have to look into the audit daemon.

http://security.blogoverflow.com/2013/01/a-brief-introduction-to-auditd/
http://xmodulo.com/2013/05/how-to-monitor-file-access-on-linux.html

/K