Monitoring Files for Changes

Owned by Paul McClendon (Unlicensed)
Last updated: Mar 10, 2020 by andresa (Unlicensed)
2 min read

Note: This Feature is Available in Open-AudIT Enterprise ONLY

For auditing and security purposes it can be advantageous to monitor individual files or all files in a folder, for changes. Open-AudIT Enterprise has the ability to audit files on both Windows and Linux operating systems.

  1. Identify the files/folders you are interested in monitoring.
    1. We recommend starting with an individual file to test and understand how the system works
    2. Document the file name and extension with full path; i.e. /usr/local/nmis8/conf/Config.nmis, for example
    3. Paths and filenames are case sensitive if the OS hosting the file is (Linux for example)
  2. Create an individual entry for each File/Folder
    1. Select Discover -> Files -> List Files from the Open-AudIT Enterprise menu
    2. To create a new entry click the "+"  button in the top-right hand corner
    3. The path should be the fully qualified path to the file along with the full file name and extension. Wildcard characters are not supported at this time. For Windows files, the path must include the drive letter.
    4. More information on Files can be found HERE: Files
  3. Determine how often you want to be notified of changes to the files/folders and create a Scheduled Report
    1. Open-AudIT ships with a report specifically for changes to monitored files; select Report -> Changes -> Files from the menu
    2. This report can be edited or a copy made to display any additional attributes you need. This process is covered HERE: Queries
    3. Once you've identified the Queries you want to run and adjusted them to include the information you need you can schedule them to run on whatever schedule makes the most sense. Keep in mind, however, that all Queries are running off information contained in the database and not checking for changes to the files themselves. As a result, you should schedule your reports to run at some time after your Discoveries are done running. More information on scheduling your File Change report can be found HERE: How to Schedule Tasks in Open-AudIT