Monitoring File Changes
File Change Detection Methods
graph TD
A[File Change Monitoring] --> B[Real-time Tracking]
A --> C[Periodic Checking]
A --> D[System Logging]
Installation
sudo apt-get install inotify-tools
Basic Monitoring Commands
## Monitor specific file
inotifywait -m /path/to/file
## Monitor directory for changes
inotifywait -m -r /path/to/directory
2. Find Command: Periodic Checking
Tracking Recent Changes
## Find files modified in last 24 hours
find /path -type f -mtime -1
## Find files changed in last hour
find /path -type f -mmin -60
Monitoring Techniques
Technique |
Use Case |
Performance |
inotify |
Real-time tracking |
High |
Find command |
Periodic scanning |
Low overhead |
Auditd |
System-wide logging |
Comprehensive |
3. Auditd: Advanced System Monitoring
Installation
sudo apt-get install auditd
Configuration Example
## Add file monitoring rule
sudo auditctl -w /path/to/file -p warx
Scripting File Change Detection
#!/bin/bash
## Simple file change tracking script
LAST_MODIFIED=$(stat -c %Y "$1")
while true; do
CURRENT_MODIFIED=$(stat -c %Y "$1")
if [ "$LAST_MODIFIED" != "$CURRENT_MODIFIED" ]; then
echo "File $1 has changed!"
LAST_MODIFIED=$CURRENT_MODIFIED
fi
sleep 5
done
4. Kernel-level Monitoring with fanotify
## Kernel-level file event monitoring
sudo setcap cap_sys_admin+ep /path/to/monitoring/script
Best Practices
- Choose appropriate monitoring method
- Consider system performance
- Implement logging
- Set up proper access controls
LabEx Tip
Explore file change monitoring techniques in LabEx's controlled Linux environments to gain practical experience with different tracking methods.