monitoring files

[bdina]

How can I monitor a file to see who wrote to it last, and from what program it was written in case it was a script that wrote to the file through the root account.

thanks,
--Bryan

 

[LinuXelite]

I think you might be interested by Tripwire.

Tripwire software is a tool that checks to see what has changed on your system. The program monitors key attributes of files that should not change, including binary signature, size, expected change of size, etc.

Tripwire is originally known as an intrusion detection tool, but can be used for many other purposes such as integrity assurance, change management, policy compliance and more.

http://www.tripwire.org