fschange deprecated; what options are available

[joonradley]

The 5.0 release documentation states that fschange is deprecated.

We use this extensively for configuration change detection. Does anyone know of how to get the same functionality as fschange on Linux and Windows?

Thx

[joonradley]

Any product will do at the moment.

[kristian_kolb]

For Linux, I'd guess that the auditd would be able to solve most things. Configuring it to be less noisy is probably an exercise.

For Windows, I'd guess that you have to enable auditing on "object access", and set ACL's on the objects (files/directories) you wish to monitor. Exactly how to do this is a bit beyond my experience.

[miteshvohra]

TripWire does a good job of monitoring changes. Unsure if there is a ready made app for it.

My two cents.

[joonradley]

Unfortunately I also need to track the changed contents as well.

[kristian_kolb]

Not too sure about that - or rather, I'm quite certain you can't. But what you will get is WHO made the change.

[joonradley]

Can you pull in the entire configuration file with these methods?

[Ayn]

Do you mean using Splunk exclusively, or do you want to know about other products that could solve this for you?