The Linux kernel has auditing capabilities.
You can install the packages auditd
and system-config-audit
to take advantage of this.
sudo apt-get install auditd system-config-audit
then to avoid an error you would get later, make a symlink of /usr/sbin/service
to /sbin/
:
sudo ln -s /usr/sbin/service /sbin/
Then launch the configuration interface:
gksu system-config-audit
Go to Configuration page
then click on the button Edit near File watches
click on the Add button
then enter the details of the executable you want to monitor, together with an optional distinctive string (just LS
here), as in the following screenshot
Press OK, OK, Save and Save.
Now you can see the log of the monitored events with
sudo less /var/log/audit/audit.log
and you should get an output similar to the following:
type=DAEMON_START msg=audit(1325523963.095:8698): auditd start, ver=1.7.13 format=raw kernel=3.0.0-14-generic auid=4294967295 pid=31838 subj=unconfined res=success
type=CONFIG_CHANGE msg=audit(1325523963.196:35): audit_enabled=1 old=1 auid=4294967295 ses=4294967295 res=1
type=CONFIG_CHANGE msg=audit(1325523963.196:36): audit_backlog_limit=320 old=320 auid=4294967295 ses=4294967295 res=1
type=DAEMON_END msg=audit(1325524792.575:8699): auditd normal halt, sending auid=0 pid=32105 subj= res=success
type=DAEMON_START msg=audit(1325524792.613:8877): auditd start, ver=1.7.13 format=raw kernel=3.0.0-14-generic auid=4294967295 pid=32115 subj=unconfined res=success
type=CONFIG_CHANGE msg=audit(1325524792.712:39): audit_enabled=1 old=1 auid=4294967295 ses=4294967295 res=1
type=CONFIG_CHANGE msg=audit(1325524792.712:40): audit_enabled=1 old=1 auid=4294967295 ses=4294967295 res=1
type=CONFIG_CHANGE msg=audit(1325524792.712:41): audit_failure=1 old=1 auid=4294967295 ses=4294967295 res=1
type=CONFIG_CHANGE msg=audit(1325524792.716:42): audit_backlog_limit=320 old=320 auid=4294967295 ses=4294967295 res=1
type=CONFIG_CHANGE msg=audit(1325524792.716:43): audit_rate_limit=0 old=0 auid=4294967295 ses=4294967295 res=1
type=CONFIG_CHANGE msg=audit(1325524792.716:44): auid=4294967295 ses=4294967295 op="add rule" key="ls" list=4 res=1
type=DAEMON_END msg=audit(1325524929.107:8878): auditd normal halt, sending auid=0 pid=32168 subj= res=success
type=DAEMON_START msg=audit(1325524929.139:3658): auditd start, ver=1.7.13 format=raw kernel=3.0.0-14-generic auid=4294967295 pid=32178 subj=unconfined res=success
type=CONFIG_CHANGE msg=audit(1325524929.241:48): audit_enabled=1 old=1 auid=4294967295 ses=4294967295 res=1
type=CONFIG_CHANGE msg=audit(1325524929.241:49): audit_enabled=1 old=1 auid=4294967295 ses=4294967295 res=1
type=CONFIG_CHANGE msg=audit(1325524929.241:50): audit_failure=1 old=1 auid=4294967295 ses=4294967295 res=1
type=CONFIG_CHANGE msg=audit(1325524929.241:51): audit_backlog_limit=320 old=320 auid=4294967295 ses=4294967295 res=1
type=CONFIG_CHANGE msg=audit(1325524929.241:52): audit_rate_limit=0 old=0 auid=4294967295 ses=4294967295 res=1
type=CONFIG_CHANGE msg=audit(1325524929.241:53): auid=4294967295 ses=4294967295 op="add rule" key="ls" list=4 res=1
type=DAEMON_END msg=audit(1325525132.140:3659): auditd normal halt, sending auid=0 pid=32407 subj= res=success
type=DAEMON_START msg=audit(1325525132.173:6001): auditd start, ver=1.7.13 format=raw kernel=3.0.0-14-generic auid=4294967295 pid=32417 subj=unconfined res=success
type=CONFIG_CHANGE msg=audit(1325525132.274:57): audit_enabled=1 old=1 auid=4294967295 ses=4294967295 res=1
type=CONFIG_CHANGE msg=audit(1325525132.274:58): audit_enabled=1 old=1 auid=4294967295 ses=4294967295 res=1
type=CONFIG_CHANGE msg=audit(1325525132.274:59): audit_failure=1 old=1 auid=4294967295 ses=4294967295 res=1
type=CONFIG_CHANGE msg=audit(1325525132.274:60): audit_backlog_limit=320 old=320 auid=4294967295 ses=4294967295 res=1
type=CONFIG_CHANGE msg=audit(1325525132.278:61): audit_rate_limit=0 old=0 auid=4294967295 ses=4294967295 res=1
type=CONFIG_CHANGE msg=audit(1325525132.278:62): auid=4294967295 ses=4294967295 op="add rule" key="ls" list=4 res=1
type=SYSCALL msg=audit(1325525137.354:63): arch=c000003e syscall=59 success=yes exit=0 a0=2506d48 a1=2500308 a2=249a008 a3=7fffe4130170 items=2 ppid=30147 pid=32431 auid=4294967295 uid=1000 gid=1000 euid=1000 suid=1000 fsuid=1000 egid=1000 sgid=1000 fsgid=1000 tty=pts2 ses=4294967295 comm="ls" exe="/bin/ls" key="ls"
type=EXECVE msg=audit(1325525137.354:63): argc=5 a0="ls" a1="--color=auto" a2="--group-directories-first" a3="--time-style=long-iso" a4="--ignore-backups"
type=CWD msg=audit(1325525137.354:63): cwd="/home/enzotib"
type=PATH msg=audit(1325525137.354:63): item=0 name="/bin/ls" inode=389459 dev=08:02 mode=0100755 ouid=0 ogid=0 rdev=00:00
type=PATH msg=audit(1325525137.354:63): item=1 name=(null) inode=395716 dev=08:02 mode=0100755 ouid=0 ogid=0 rdev=00:00
where on the last lines you could see the ls
invocation a run for test. Ok, the log file is not so simple to read, but with some text processing you can get the output you want.