Bash script to maintain audit trail / log of files accessed

Question

I searched the AskUbuntu database but the closest thing I found was a question on how to log errors.

What I'm looking for is to append to a log file / audit trail every time sudo gedit / gksu gedit / pkexec gedit is used. In reality I'll be using a wrapper script called gsu that calls pkexec gedit.

What I would like to do is append to a audit file say ~/gedit-log the following:

YYYY-MM-DD hh:mm:ss Count /SystemDirectoryName/SystemFileName

Keep in mind I may navigate to /SystemDirectoryName and then call gsu gedit SystemFileName so the the first parameter can't be automatically used because the path must be prepended. Therefore a bash command "here is the file name, give me the full path and file name" is required.

The current date and time should be in human readable format (not the number of seconds from 1970 (epoch time)). The Date and Time mask in the example is probably inappropriate and should conform to industry standards instead.

A command is needed to append the combination string + CR/LF (Carriage Return Line Feed) to the audit trail / log file.

Down the road a massaging program / script would be needed to tally up all the times a given file has been edited (/etc/default/grub could get a lot of edits) into the "count" field and delete the extraneous records. This would probably be a cron daily job?

It might make sense to have two date/time fields. One for first time changed and one for last time changed.

Hopefully this code already exists in the Linuxverse or something close to it can be easily adapted.

The code itself might be put into a separate bash script so it can be re-purposed for many situations... ie this user edited that payroll file, etc.

Answer 1

The simplest answer for me to wrap my head around is not using journalctl derivatives but rather "brute force" programming / scripting.

Here is the code.

~/bin/gsu:

#!/bin/bash

# Usage: gsu gedit file1 file2...
#  -OR-  gsu natuilus /dirname

# & is used to spawn process and get prompt back ASAP
# > /dev/null is used to send gtk warnings into dumpster

COMMAND="$1" # extract gedit or nautilus

pkexec "$COMMAND" "${@:2}"

log-file "${@:2}" gsu-log-file-for-"$COMMAND"

/usr/local/bin/log-file:

#! /bin/bash

# NAME: log-file
# PATH: /usr/local/bin
# DESC: Update audit trail/log file with passed parameters.
# CALL: log-file FileName LogFileName
# DATE: Created Nov 18, 2016.
# NOTE: Primarily called from ~/bin/gsu

ABSOLUTE_NAME=$(realpath "$1")
TIME_STAMP=$(date +"%D - %T")
LOG_FILE="$2"

# Does log file need to be created?
if [ ! -f "$LOG_FILE" ]; then
    touch "$LOG_FILE"
    echo "__Date__ - __Time__ - ______File Name______" >> "$LOG_FILE"
    #     MM/DD/YY - hh:mm:ss - "a/b/c/FileName"
fi

echo "$TIME_STAMP" - '"'"$ABSOLUTE_NAME"'"' >> "$LOG_FILE"

exit 0

Contents of log file gsu-log-file-for-geditafter a few edits:

__Date__ - __Time__ - ______File Name______
11/18/16 - 19:07:54 - "/etc/default/grub"
11/18/16 - 19:08:34 - "/home/rick/bin/gsu"
11/18/16 - 19:09:26 - "/home/rick/bin/gsu"

Future enhancements

A consolidation script which will take take last two lines and merge them into:

11/18/16 - 19:09:26 - "/home/rick/bin/gsu" (2 edits, first on 11/18/16 - 19:08:34"