Question

I need to audit the directory and call a script with the file-path parameter as the file is created there. Reading the man of auditctl i can’t find a way to do it.

There’re references in the web to inotify or iwatch services, that should do what i need, but i’d rather use the standard auditd functionality not installing an extra software.

If that’s really not possible to use auditd to track the file creation and call the script for that file, a short sample of iwatch/inotify command to do the trick will be appreciated and accepted.

Answer 1

For the CentOs environment pyinotify module was used which handles directories watch pretty well and triggers the desired scripts.

Unfortunately i wasn’t able to find solution using pure auditd.

The list of examples of how do someone use pyinotify is here.