file-audit-system

File monitoring software that will log file access to configured directories on the system.

Assumptions

Linux OS
Recent version of linux kernel, I used 5.3.7
systemd based OS
libaudit is available and installed in the system
libpthread is available and installed in the system
auditd and friends are available and installed in the system

Debugging

Reinstall new version:
- sudo killall auditd && make && sudo make install && sudo systemctl start auditd
Gdb analysis of core in case of crash
- sudo coredumpctl -1 gdb
Following debugging output
- journalctl -fu auditd

Install

1. Build

mkdir build
cmake -DCMAKE_BUILD_TYPE=RelWithDebInfo ..
make
sudo make install

2. Run install.sh

sudo install.sh

See it in action:

tail -f /tmp/file-monitor.log
- Change above for different logs
journalctl -fu auditd
- Watch here for any relevant app logs

Todo

Is nametype truly the file access type?
Add executable arguments to specify different config file
Not such a hardcoded config file location ("/etc/file-monitor.conf")
Make audit events logged configurable