Could anyone help explain this?

ETC Homework & Coursework Questions
1
  1. The problem statement, all variables and given/known data:

I have a retake assignment to complete for my computer networks and OS class. This isn't really my area, had I known last year I could have swapped it for a different module I would have done so. I'm determined to get through it though.

Anyhow I digress. I am having trouble properly understanding the brief or where to begin it states:

"Monitoring a GNU/Linux system for changes:

For this referral assignment you are required to show how you might monitor important system directories in a GNU/Linux operating system for any changes in files or directories. Marks will be given as follows:

A) Provide an outline of which directories and files that you consider should be monitored for changes along with an indication of which changes you would monitor and how you would monitor them. ( up to 20%)

B) Provide a summary of available tools and utilities, both open source and commercial, that would help with this task. Your summary should include an indication of cost, complexity in
use and complexity in setup. ( up to 30%)

C) Develop a script or program that will implement at least some of the functionality required to support your analysis from (A). This script should keep a log of any changes found. The
script or program can be written in C, PERL, shell script or any other language that will execute on a GNU/Linux system. ( up to 50%)".

  1. Relevant commands, code, scripts, algorithms:

N/A

  1. The attempts at a solution (include all code and scripts):

I have a few theories and have been trying to do some research online but haven't found too much.

If anyone can help point me in the right direction it would be greatly appreciated.

  1. School (University) and Course Number:

University of the West of England, Computing degree.

2

First, you need to determine what are the files that need to be monitored.

Did you attempt to do that yet?

---------- Post updated at 13:52 ---------- Previous update was at 13:49 ----------

Note: I Googled:

files to be monitored linux - Google Search

and found a lot of info......

3

Hint 1: Generally, all files that aren't intended to be changed by a normal user can be considered worth watching. Think configuration files and bin directories.
Hint 2: A good indication of change can be found by using cryptographic hashing functions
Hint 3: A Tripwire can tell you when something is happening.

Yes, I'm being sketchy on purpose :slight_smile:

4

Thanks for the replies :).

I have been scouring Google for answers, found a few gems but also found it hard to understand quite a bit of it. As I said it's not really my area, I'd have rather swapped it for a media based module etc etc.

Thanks for being sketchy too, your hints have given me food for thought.

5

Hint: If you read the Tripwire documentation, you should be "good to go"......

Good luck.

6

Thanks. I'm giving it a read now.

7

you might take a look at this (inotify),
Filesystem Monitoring (Tom's Linux Tip's)